CVE-2025-36462

HIGH

Dell ControlVault3 <5.15.14.19-6.2.36.47 - Memory Corruption

Title source: llm
STIX 2.1

Description

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 3 (`WBIO_USH_CREATE_CHALLENGE`) with an invalid `ReceiveBuferSize`.

References (2)

Core 2

Scores

CVSS v3 7.3
EPSS 0.0002
EPSS Percentile 4.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-805
Status published
Products (3)
Broadcom/BCM5820X
Dell/ControlVault3 < 5.15.14.19
Dell/ControlVault3 Plus < 6.2.36.47
Published Nov 17, 2025
Tracked Since Feb 18, 2026