CVE-2025-0285 Overview
CVE-2025-0285 is a local privilege escalation vulnerability in the biontdrv.sys kernel driver shipped with multiple Paragon Software products. The driver fails to properly validate the length of user-supplied data, allowing an authenticated local attacker to map arbitrary kernel memory. A successful exploit permits an attacker to elevate privileges from a standard user to SYSTEM. The affected driver is signed by Paragon Software, which means the vulnerable driver can also be leveraged in Bring Your Own Vulnerable Driver (BYOVD) attacks even on systems that never had a Paragon product installed. The weakness is tracked as [CWE-1284] (improper validation of specified quantity in input).
Critical Impact
Local attackers can escalate to SYSTEM privileges by sending crafted IOCTLs to the vulnerable biontdrv.sys driver, and the signed driver is portable to BYOVD scenarios.
Affected Products
- Paragon Backup & Recovery
- Paragon Hard Disk Manager
- Paragon Partition Manager, Paragon Drive Copy, Paragon Disk Wiper, and Paragon Migrate OS to SSD
Discovery Timeline
- 2025-03-03 - CVE-2025-0285 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-0285
Vulnerability Analysis
The vulnerability resides in biontdrv.sys, a kernel-mode driver that ships with the Paragon Hard Disk Manager product line. The driver exposes IOCTL handlers accessible from user mode. One of these handlers accepts a length value from the caller and uses it in a memory mapping operation without adequate bounds checking. Because the driver runs in kernel context, the flaw allows a local user to influence which kernel memory ranges get mapped into an attacker-controlled context. This primitive is sufficient to read or overwrite kernel structures and pivot to full SYSTEM execution. See CERT Vulnerability Detail #726882 for the coordinated disclosure notes.
Root Cause
The root cause is improper validation of the size field within data supplied through an IOCTL to biontdrv.sys. The driver trusts the caller-provided length and performs kernel memory mapping based on it. Missing bounds checks let an attacker specify sizes or offsets that reach kernel address ranges the caller should not access.
Attack Vector
Exploitation requires local, authenticated access to a system with the vulnerable driver loaded. An attacker opens a handle to the driver device, issues the vulnerable IOCTL, and supplies malformed length parameters. Because biontdrv.sys is Microsoft-signed through Paragon's driver signing, attackers can drop the driver on any Windows host to weaponize it in BYOVD workflows and disable endpoint security tooling.
No verified public proof-of-concept code is available. Refer to the Paragon Software Security Patch advisory for vendor technical details.
Detection Methods for CVE-2025-0285
Indicators of Compromise
- Presence of biontdrv.sys on hosts that do not have a legitimate Paragon Software installation, which is a strong indicator of BYOVD staging.
- Unexpected loads of biontdrv.sys by non-Paragon parent processes, particularly from user-writable directories such as %TEMP% or %APPDATA%.
- New service or driver registration entries pointing to a biontdrv.sys image outside of Paragon's install path.
Detection Strategies
- Inventory endpoints for the biontdrv.sys driver and compare hashes against the patched vendor-supplied version.
- Alert on IOCTL activity targeting the Paragon driver device object from non-Paragon user-mode processes.
- Monitor Microsoft's Vulnerable Driver Blocklist status and confirm the pre-patch biontdrv.sys hashes are enforced by Windows Defender Application Control (WDAC) or Hypervisor-Protected Code Integrity (HVCI).
Monitoring Recommendations
- Enable kernel driver load logging (Sysmon Event ID 6) and forward events to a centralized SIEM for hunting on unsigned or older-signed driver versions.
- Track privilege-escalation chains where a standard user process spawns a SYSTEM-level child shortly after a driver load event.
- Correlate suspicious driver loads with subsequent tampering of endpoint security services and process token manipulation.
How to Mitigate CVE-2025-0285
Immediate Actions Required
- Apply Paragon's patched driver across all Hard Disk Manager product line installations as listed in the vendor advisory.
- Enable the Microsoft Vulnerable Driver Blocklist on Windows 10, Windows 11, and Windows Server to block the pre-patch biontdrv.sys from loading.
- Restrict local logon and standard user access on high-value hosts to limit the population of accounts able to trigger the driver.
Patch Information
Paragon Software has released updated drivers for the Hard Disk Manager product line. Download the patched builds from the Paragon Software Security Patch advisory and the Paragon Software Patches Support Page. Confirm the driver version after installation and verify the old biontdrv.sys image is not left behind on disk.
Workarounds
- If patching cannot be performed immediately, uninstall the affected Paragon product and remove biontdrv.sys from %SystemRoot%\System32\drivers\.
- Enforce the Microsoft recommended driver blocklist via WDAC to prevent the vulnerable driver from being loaded even if reintroduced by BYOVD tooling.
- Enable HVCI and Memory Integrity to raise the cost of kernel memory tampering attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
