BaseFortify

Publication date: 2025-11-17

Last updated on: 2025-11-18

Assigner: Talos

Description

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 2 (`WBIO_USH_GET_IDENTITY`) with an improper `ReceiveBuferSize` value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-17

Last Modified

2025-11-18

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-04

NVD

CVE-2025-36460

Affected Vendors & Products

Vendor	Product	Version / Range
dell	controlvault3	*
dell	controlvault3_plus	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-805	The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

Attack-Flow Graph

Executive Summary

This vulnerability involves multiple out-of-bounds read and write issues in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 and Dell ControlVault3 Plus before certain versions. Specifically, a specially crafted WinBioControlUnit API call with ControlCode 2 and a ReceiveBufferSize between 5 and 79 can cause an out-of-bounds write of up to 75 bytes. This can lead to memory corruption, potentially allowing an attacker to manipulate memory if they can control the data in the identity database.

Impact Analysis

This vulnerability can lead to memory corruption, which may allow an attacker with limited privileges to escalate their access or cause denial of service. Because the vulnerability affects confidentiality, integrity, and availability (all rated high), it could result in unauthorized access to sensitive data, system instability, or crashes.

Hi! I’m here to help you understand CVE-2025-36460. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70