Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-36460

Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
talos

Description

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 2 (`WBIO_USH_GET_IDENTITY`) with an improper `ReceiveBuferSize` value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Broadcom BCM5820X

Default version status: unaffected

  • NAaffected

Dell ControlVault3

Default version status: unaffected

  • 0 to < 5.15.14.19affected

Dell ControlVault3 Plus

Default version status: unaffected

  • 0 to < 6.2.36.47affected

References