CVE-2025-36460

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-36460
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 2 (`WBIO_USH_GET_IDENTITY`) with an improper `ReceiveBuferSize` value.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2025-2175
https://www.dell.com/support/kbdoc/en-us/000326061/dsa-2025-228
Configurations

No configuration.

History

18 Nov 2025, 03:15

Type Values Removed Values Added
Summary (en) Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 2 (`WBIO_USH_GET_IDENTITY`) with `4 <= ReceiveBuferSize < 80` This will lead to an out-of-bound write of up to 75 bytes. These can be either null-bytes or potentially attacker controlled data if another vulnerability is leveraged to place attacked-controlled data as Identity inside the database. (en) Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 2 (`WBIO_USH_GET_IDENTITY`) with an improper `ReceiveBuferSize` value.

17 Nov 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-17 23:15

Updated : 2025-11-18 14:06

NVD link : CVE-2025-36460

Mitre link : CVE-2025-36460

CVE.ORG link : CVE-2025-36460

JSON object : View

Products Affected

No product.

CWE
CWE-805

Buffer Access with Incorrect Length Value