Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-14 | 1 | Active Exploitation1 |
| 2026-06-28 | 1 | General1 |
Published a root cause analysis of CVE-2025-0288 in BioNTDrv.sys. https://meisameb.github.io/posts/cve-2025-0287/
Post summary
A root cause analysis of CVE‑2025‑0288 in BioNTDrv.sys has been published, offering technical details about the flaw but no PoC, exploit code, or evidence of active exploitation.
🚨 [HIGH] Active exploitation detected: CVE-2025-0288 Exploit in the wild confirmed for CVE-2025-0288 (CVSS null). Various Paragon Software products contain an arbitrary kernel memory vulnerability within... 🔗 http://ctiwatch.cloud/alerts #ZeroDay #ExploitInWild #CyberSecurity
Post summary
The post confirms that CVE-2025-0288 is being actively exploited in the wild against Paragon Software products, with an arbitrary kernel memory vulnerability, but no patches or exploit code details are provided.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | paragon-software | paragon_backup_\&_recovery | - | - | - |
| App | paragon-software | paragon_disk_wiper | - | - | - |
| App | paragon-software | paragon_drive_copy | - | - | - |
| App | paragon-software | paragon_hard_disk_manager | - | - | - |
| App | paragon-software | paragon_migrate_os_to_ssd | - | - | - |
| App | paragon-software | paragon_partition_manager | - | - | - |