Various Paragon Software products contain an arbitrary kernel memory write vulnerability…
Priority LOW 39CWE-1284Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Various Paragon Software products contain an arbitrary kernel memory write vulnerability within biontdrv.sys that is caused by a failure to properly validate the length of user supplied data, which can allow an attacker to execute arbitrary code on the victim machine.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Paragon Software | Partition Manager | 15 – 17.39 | — | No fix listed | CNA |
| Paragon Software | Hard Disk Manager | 15 – 17.39 | — | No fix listed | CNA |
| Paragon Software | Backup and Recovery | 15 – 17.39 | — | No fix listed | CNA |
| Paragon Software | Drive Copy | 15 – 16 | — | No fix listed | CNA |
| Paragon Software | Disk Wiper | 15 – 16 | — | No fix listed | CNA |
| Paragon Software | Migrate OS to SSD | 4 – 5 | — | No fix listed | CNA |
- Partition Manager VendorParagon Software Affected 15 – 17.39 Fixed in — No fix listed CNA
- Hard Disk Manager VendorParagon Software Affected 15 – 17.39 Fixed in — No fix listed CNA
- Backup and Recovery VendorParagon Software Affected 15 – 17.39 Fixed in — No fix listed CNA
- Drive Copy VendorParagon Software Affected 15 – 16 Fixed in — No fix listed CNA
- Disk Wiper VendorParagon Software Affected 15 – 16 Fixed in — No fix listed CNA
- Migrate OS to SSD VendorParagon Software Affected 4 – 5 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:paragon-software:paragon_backup_\&_recovery:*:*:*:*:*:*:*:* | 15 – 17.39 | Vulnerable | Paragon Software |
| cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:* | 15 – 16 | Vulnerable | Paragon Software |
| cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:* | 15 – 16 | Vulnerable | Paragon Software |
| cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:* | 15 – 17.39 | Vulnerable | Paragon Software |
| cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:* | 4 – 5 | Vulnerable | Paragon Software |
| cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:* | 15 – 17.39 | Vulnerable | Paragon Software |
- cpe:2.3:a:paragon-software:paragon_backup_\&_recovery:*:*:*:*:*:*:*:* Versions 15 – 17.39 Vulnerable ·Paragon Software
- cpe:2.3:a:paragon-software:paragon_disk_wiper:*:*:*:*:*:*:*:* Versions 15 – 16 Vulnerable ·Paragon Software
- cpe:2.3:a:paragon-software:paragon_drive_copy:*:*:*:*:*:*:*:* Versions 15 – 16 Vulnerable ·Paragon Software
- cpe:2.3:a:paragon-software:paragon_hard_disk_manager:*:*:*:*:*:*:*:* Versions 15 – 17.39 Vulnerable ·Paragon Software
- cpe:2.3:a:paragon-software:paragon_migrate_os_to_ssd:*:*:*:*:*:*:*:* Versions 4 – 5 Vulnerable ·Paragon Software
- cpe:2.3:a:paragon-software:paragon_partition_manager:*:*:*:*:*:*:*:* Versions 15 – 17.39 Vulnerable ·Paragon Software
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0286
- 2026-10-03 Alias added: GHSA-6pcr-45mv-9gp3
References
More Paragon Software Paragon Backup & Recovery vulnerabilities
- TI-2025-00231 Various Paragon Software products contain an arbitrary kernel memory vulnerability within… CVSS 3.1HIGH 7.8
- TI-2025-00232 Various Paragon Software products contain an insecure kernel resource access… CVSS 3.1HIGH 7.8
- TI-2025-00228 Various Paragon Software products contain an arbitrary kernel memory mapping… CVSS 3.1HIGH 7.8
- TI-2025-00230 NULL pointer dereference in Paragon Software Migrate OS to SSD CVSS 3.1MEDIUM 5.1
Sources
- CVE-2025-0286 · CVE Program
- CVE-2025-0286 · NVD
- FIRST EPSS
- GHSA-6pcr-45mv-9gp3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences