Out-of-Bounds Read and Write Vulnerabilities in Dell ControlVault3 Products

CVE-2025-36462

What is CVE-2025-36462?

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver functionality of Dell ControlVault3 and Dell ControlVault3 Plus. When an attacker issues a specially crafted WinBioControlUnit call with specific parameters, it can lead to memory corruption by writing null-bytes beyond the intended memory boundaries. This vulnerability is associated with the ControlCode 3 (WBIO_USH_CREATE_CHALLENGE) and can occur when the ReceiveBuferSize is in a specific range. Addressing these vulnerabilities is crucial to prevent potential exploitation.

References