CVE-2025-0287: Paragon Backup & Recovery Privilege Escalation

CVE-2025-0287 Overview

CVE-2025-0287 is a null pointer dereference vulnerability [CWE-476] in the biontdrv.sys kernel driver shipped with multiple Paragon Software products. The flaw stems from the driver failing to validate the presence of a valid MasterLrp structure in the user-supplied input buffer. A local attacker who can send crafted I/O control requests to the driver can trigger kernel-mode code execution and escalate privileges on the affected host. Because biontdrv.sys is a signed Microsoft-trusted driver, the issue is also relevant to Bring Your Own Vulnerable Driver (BYOVD) attack scenarios, where adversaries load the driver on systems that do not have Paragon products installed.

Critical Impact
Local attackers can execute arbitrary code in the Windows kernel through the Paragon biontdrv.sys driver, enabling privilege escalation to SYSTEM.

Affected Products

Paragon Backup & Recovery
Paragon Hard Disk Manager
Paragon Partition Manager, Drive Copy, Disk Wiper, and Migrate OS to SSD

Discovery Timeline

2025-03-03 - CVE-2025-0287 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0287

Vulnerability Analysis

The vulnerability resides in biontdrv.sys, a kernel-mode driver component bundled with the Paragon Hard Disk Manager product line. The driver exposes I/O control (IOCTL) interfaces that accept user-mode input buffers. When processing one of these requests, the driver dereferences a pointer that is expected to reference a MasterLrp structure without first confirming the structure exists in the supplied buffer.

Because the dereference occurs in kernel context, an attacker who controls the memory layout can convert the invalid pointer access into arbitrary kernel memory write primitives. This enables SYSTEM-level code execution from an unprivileged local context. The driver is signed by a trusted authority, so BYOVD operators can drop and load it on hosts that never installed Paragon software, bypassing user-mode privilege boundaries.

Root Cause

The root cause is missing input validation in the IOCTL handler. The handler assumes the input buffer contains a well-formed MasterLrp structure and proceeds to dereference offsets within it. When the structure is absent or malformed, the driver reads from an attacker-influenced address, producing the null pointer dereference condition tracked under [CWE-476].

Attack Vector

Exploitation requires local access and the ability to open a handle to the biontdrv.sys device object and issue IOCTLs. No authentication to the driver interface is required beyond standard Windows device access. See the CERT Vulnerability Note VU#726882 for additional technical analysis of the IOCTL interface and exploitation preconditions.

// No public proof-of-concept code is available for CVE-2025-0287.
// Technical details are described in prose above; refer to the
// CERT advisory for additional analysis of the affected IOCTL handler.

Detection Methods for CVE-2025-0287

Indicators of Compromise

Presence of biontdrv.sys on hosts that do not have Paragon products legitimately installed, which is a strong signal of BYOVD activity.
Unexpected service or driver load events referencing biontdrv.sys originating from user-writable directories such as %TEMP% or %APPDATA%.
Kernel crashes (BSOD) with bugcheck codes consistent with null pointer dereferences shortly after a biontdrv.sys load event.

Detection Strategies

Monitor Windows Event Log IDs 7045 (service installation) and Sysmon Event ID 6 (driver load) for biontdrv.sys entries outside of Paragon installer activity.
Hunt for processes opening handles to the Paragon device object followed by DeviceIoControl calls originating from non-Paragon binaries.
Correlate driver load events with subsequent process token manipulation or new SYSTEM-context processes.

Monitoring Recommendations

Enable the Microsoft Vulnerable Driver Blocklist and track block events generated by Hypervisor-Protected Code Integrity (HVCI).
Maintain an inventory of signed third-party kernel drivers across endpoints and alert on first-seen instances of biontdrv.sys.
Review EDR telemetry for privilege escalation chains where an unprivileged process is followed by SYSTEM-level child processes after a kernel driver load.

How to Mitigate CVE-2025-0287

Immediate Actions Required

Apply the patched Paragon driver release described in the Paragon Security Patch Announcement on all systems running affected products.
Enable or update the Microsoft Vulnerable Driver Blocklist so Windows refuses to load vulnerable versions of biontdrv.sys.
Remove biontdrv.sys from any system that does not require Paragon functionality to reduce BYOVD exposure.

Patch Information

Paragon Software released updated drivers for the Hard Disk Manager product line that validate the MasterLrp structure before dereference. Patch availability for each product is listed on the Paragon Software Patches Overview page. Microsoft has also added the vulnerable driver to its driver blocklist distributed through Windows Update.

Workarounds

Uninstall affected Paragon products from systems where the functionality is not required.
Enforce HVCI and Memory Integrity on Windows 10 and later to block unsigned or blocklisted driver loads.
Restrict local administrative access, since exploitation of BYOVD scenarios often requires driver installation privileges.

bash

# Verify the Microsoft Vulnerable Driver Blocklist is enabled (PowerShell, run as admin)
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | \
  Select-Object -ExpandProperty SecurityServicesConfigured

# Check for presence of the affected driver
Get-ChildItem -Path C:\ -Recurse -Filter biontdrv.sys -ErrorAction SilentlyContinue