CVE-2025-36462
High
Description
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 3 (`WBIO_USH_CREATE_CHALLENGE`) with an invalid `ReceiveBuferSize`.
SeverityHigh
CVSS7.3
Exploit probability—
Product
ControlVault3
PublishedNov 17, 2025
First seenNov 17, 2025
Weakness typeCWE-805CWE-805
How to fix
Update
- Dell ControlVault35.15.14.19 or later
- Dell ControlVault3 Plus6.2.36.47 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dell ControlVault3 | v < 5.15.14.19 | 5.15.14.19 |
| Broadcom BCM5820X | No range specified | — |
| Dell ControlVault3 Plus | v < 6.2.36.47 | 6.2.36.47 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.