CVE-2025-0286

Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.

Score

CVSS 3.1 8.4 High

Status

Analyzed - cret@cert.org

Published

2025-03-03

Last modified

2025-09-09

Weaknesses

CWE-1284

Affected products

• Paragon Backup & Recovery (Paragon-software)
• Paragon Disk Wiper (Paragon-software)
• Paragon Drive Copy (Paragon-software)
• Paragon Hard Disk Manager (Paragon-software)
• Paragon Migrate Os To Ssd (Paragon-software)
• Paragon Partition Manager (Paragon-software)
• Backup And Recovery (Paragon Software)
• Disk Wiper (Paragon Software)
• Drive Copy (Paragon Software)
• Hard Disk Manager (Paragon Software)
• Migrate Os To Ssd (Paragon Software)
• Partition Manager (Paragon Software)

References

• https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-P…
• https://www.kb.cert.org/vuls/id/726882
• https://www.paragon-software.com/support/#patches