Out-of-Bounds Read and Write Vulnerabilities in Dell ControlVault3 and ControlVault3 Plus

CVE-2025-36463

What is CVE-2025-36463?

Multiple out-of-bounds read and write vulnerabilities have been identified in the functionality of the ControlVault WBDI Driver, specifically impacting Dell ControlVault3 versions earlier than 5.15.14.19 and Dell ControlVault3 Plus versions prior to 6.2.36.47. These vulnerabilities arise from improper handling of WinBioControlUnit API calls that can lead to memory corruption. An exploit can be triggered by issuing a WinBioControlUnit call with a specified control code, leading to unintended memory access beyond the bounds of the allocated SendBuffer. Although the conditions for successful exploitation are strict, the potential for Denial of Service attacks exists.

References