CVE-2025-0287

CVE-2025-0287

Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.

Affected

Paragon Software · Migrate OS to SSD · Disk Wiper · Drive Copy · Backup and Recovery · Hard Disk Manager · Partition Manager

CVSS v3.1 CNA

5.1 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.35% chance of exploitation in the next 30 days, 27th percentile

Published

2025-03-03

Updated

2025-09-05

Proof-of-concept exploits (1)

• MeisamEb/CVE-2025-02882★ · 2026-01-01

Security advisories

• https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-D…
• https://www.kb.cert.org/vuls/id/726882
• https://www.paragon-software.com/support/#patches

References

• CVE Record
• NVD entry

Related

• CVE-2025-0288