Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Various Paragon Software products contain a null pointer dereference vulnerability within biontdrv.sys that is caused by a lack of a valid MasterLrp structure in the input buffer, allowing an attacker to execute arbitrary code in the kernel, facilitating privilege escalation.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-14 | 1 | Active Exploitation1 |
| 2026-06-28 | 1 | Disclosure1 |
Published a root cause analysis of CVE-2025-0288 in BioNTDrv.sys. https://meisameb.github.io/posts/cve-2025-0287/
Post summary
A root‑cause analysis of CVE‑2025‑0288 in BioNTDrv.sys was published, but the brief text gives no PoC, exploit, or patch details.
🚨 [HIGH] Active exploitation detected: CVE-2025-0287 Exploit in the wild confirmed for CVE-2025-0287 (CVSS null). Various Paragon Software products contain a null pointer dereference vulnerability within... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity
Post summary
The alert confirms CVE‑2025‑0287 is actively exploited in the wild, citing a null‑pointer dereference in Paragon products, but no PoC, patch, or false‑positive information is included.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | paragon-software | paragon_backup_\&_recovery | - | - | - |
| App | paragon-software | paragon_disk_wiper | - | - | - |
| App | paragon-software | paragon_drive_copy | - | - | - |
| App | paragon-software | paragon_hard_disk_manager | - | - | - |
| App | paragon-software | paragon_migrate_os_to_ssd | - | - | - |
| App | paragon-software | paragon_partition_manager | - | - | - |