Buffer Overflow Vulnerability in Control-M/Agent by BMC Software
CVE-2025-55116

9.3CRITICAL

Key Information:

Vendor

Bmc

Status
Control-m/agent
Vendor
CVE Published:
16 September 2025

What is CVE-2025-55116?

A buffer overflow vulnerability exists in Control-M/Agent software that allows local privilege escalation for unauthorized users. This issue affects versions 9.0.18 to 9.0.20, as well as potentially earlier unsupported versions. If an attacker gains access to a system running the affected software, they could exploit this vulnerability to execute arbitrary code with elevated privileges, posing a significant risk to system integrity and confidentiality. It is crucial for users to mitigate this vulnerability by reviewing available advisories and applying necessary patches.

Affected Version(s)

Control-M/Agent 9.0.21

Control-M/Agent 9.0.20

Control-M/Agent 9.0.19

References

https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
vendor-advisory
https://bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?...
mitigation

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Airbus SAS - Jean-Romain Garnier - [email protected]
Airbus SAS - Mathieu Baudon - [email protected]
.
CVE-2025-55116 : Buffer Overflow Vulnerability in Control-M/Agent by BMC Software