What’s Vulnerable › Vulnerabilities

CVE-2025-0287: CVE-2025-0287

• Severity: medium (CVSS 5.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-03 · updated 2026-06-17
• Weakness: CWE-476

Description

Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.

Affected products

• Paragon-Software Paragon Backup & Recovery: from 15 through 17.39
• Paragon-Software Paragon Disk Wiper: from 15 through 16
• Paragon Software Paragon Drive Copy: from 15 through 16
• Paragon-Software Paragon Hard Disk Manager: from 15 through 17.39
• Paragon-Software Paragon Migrate Os To Ssd: from 4 through 5
• Paragon-Software Paragon Partition Manager: from 15 through 17.39

References

• https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys
• https://www.kb.cert.org/vuls/id/726882
• https://www.paragon-software.com/support/#patches

Get alerted when CVE-2025-0287 or the next vulnerability affects your stack