Out-of-Bounds Vulnerabilities in Dell ControlVault3 and ControlVault3 Plus

CVE-2025-36460

What is CVE-2025-36460?

Multiple out-of-bounds vulnerabilities have been identified in the functionality of Dell ControlVault3 and ControlVault3 Plus, primarily affecting the ControlVault WBDI Driver. These vulnerabilities can be exploited through a specially crafted API call, specifically via the WinBioControlUnit, which may cause memory corruption. The critical aspect is the submission of a control code that manipulates the received buffer size, potentially allowing attackers to overwrite memory with controlled data if additional vulnerabilities are present.

References