CVE-2025-25215

—

CVSS 3.1

8.8 high

EPSS

2%p80

Published

Jun 13, 2025 (Jun 13, 2025)

Modified

Jun 17, 2026

Description

An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.

Weakness: CWE-763
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news6 stories

⚡ Weekly Recap: BadCam Attack, WinRAR 0-Day, EDR Killer, NVIDIA Flaws, Ransomware Attacks & More

The Hacker NewsAug 12, 04:40 UTC · Aug 12, 2025Ransomware in the wildCVE-2025-54948 CVE-2025-54987 CVE-2025-8088+30 CVEs

Millions of Dell laptops could be persistently backdoored in ReVault attacks

Help Net SecurityAug 11, 08:57 UTC · Aug 11, 2025Malware CVE-2025-24311 CVE-2025-25050 CVE-2025-25215+2 CVEs

Researchers Reveal ReVault Attack Targeting Dell ControlVault3 Firmware in 100+ Laptop Models

The Hacker NewsAug 10, 08:12 UTC · Aug 10, 2025Exploit / PoC in the wildCVE-2025-25050 CVE-2025-25215 CVE-2025-24922+2 CVEs

Over 100 Dell models exposed to critical ControlVault3 firmware bugs

Security AffairsAug 7, 07:20 UTC · Aug 7, 2025Vulnerability CVE-2025-24311 CVE-2025-25215 CVE-2025-24922+2 CVEs

‘Critical’ firmware-level vulnerabilities found in laptops commonly used by security specialists

The RecordAug 5, 17:28 UTC · Aug 5, 2025Vulnerability in the wildCVE-2025-24919 CVE-2025-24311 CVE-2025-25050+2 CVEs

ReVault! When your SoC turns against you…

Cisco TalosAug 5, 13:00 UTC · Aug 5, 2025Vulnerability CVE-2025-24311 CVE-2025-25050 CVE-2025-25215+2 CVEs