CVE-2025-0289

—

CVSS 3.1

7.8 high

EPSS

<1%p26

Published

Mar 3, 2025 (Mar 3, 2025)

Modified

Jun 17, 2026

Description

Various Paragon Software products contain an insecure kernel resource access vulnerability facilitated by the driver not validating the MappedSystemVa pointer before passing it to HalReturnToFirmware, which can allows an attacker the ability to compromise the service.

Vendors: paragon-software
Products: paragon backup \& recovery, paragon disk wiper, paragon drive copy, paragon hard disk manager, paragon migrate os to ssd, paragon partition manager
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news4 stories

Desktop and IoT threat statistics for Q1 2025

Kaspersky SecurelistJun 5, 10:00 UTC · Jun 5, 2025Ransomware CVE-2025-0288 CVE-2025-0287 CVE-2025-0286+2 CVEs

Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks

The Hacker NewsMar 3, 13:56 UTC · Mar 3, 2025Ransomware CVE-2025-0289 CVE-2025-0285 CVE-2025-0286+2 CVEs

BYOVD Attacks Exploit Zero

Infosecurity MagazineMar 3, 09:35 UTC · Mar 3, 2025Ransomware CVE-2025-0289 CVE-2025-0288 CVE-2025-0287+2 CVEs

Ransomware gangs exploit a Paragon Partition Manager BioNTdrv.sys driver zero

Security AffairsMar 1, 18:52 UTC · Mar 1, 2025Ransomware in the wildCVE-2025-0289 CVE-2025-0288 CVE-2025-0287+2 CVEs