CVE-2025-24922 Overview
CVE-2025-24922 is a stack-based buffer overflow vulnerability in the securebio_identify functionality of Dell ControlVault3 firmware. The flaw affects Dell ControlVault3 versions prior to 5.15.10.14 and Dell ControlVault3 Plus versions prior to 6.2.26.36. A specially crafted malicious cv_object passed through an API call triggers the overflow, leading to arbitrary code execution within the ControlVault firmware context. The weakness is classified under [CWE-121: Stack-based Buffer Overflow].
Critical Impact
Attackers with local, low-privileged access can execute arbitrary code inside the ControlVault security processor, compromising biometric authentication, credential storage, and platform integrity.
Affected Products
- Dell ControlVault3 firmware prior to 5.15.10.14
- Dell ControlVault3 Plus firmware prior to 6.2.26.36
- Dell business-class laptops shipping with ControlVault security chips (Latitude, Precision, and similar product lines)
Discovery Timeline
- 2025-06-13 - CVE-2025-24922 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24922
Vulnerability Analysis
Dell ControlVault is a hardware security implementation that stores and processes credentials, passwords, and biometric templates on a dedicated daughterboard. The securebio_identify function handles biometric identification requests routed through the ControlVault Host API. The function processes a caller-supplied cv_object structure without adequately validating length fields against the destination stack buffer.
An attacker with local access and low privileges can invoke the biometric identification API with a malformed cv_object. The oversized payload overruns the stack frame in securebio_identify, corrupting saved return addresses and control data. Because ControlVault operates as a scope-changing security boundary between the host operating system and firmware, successful exploitation crosses trust zones. The EPSS score of 2.226% (80th percentile) reflects elevated interest relative to the broader CVE population.
Root Cause
The root cause is missing bounds validation on attacker-controlled length metadata within the cv_object argument passed to securebio_identify. Firmware copies data into a fixed-size stack buffer without checking whether the source length exceeds the destination capacity, matching the [CWE-121] pattern.
Attack Vector
Exploitation requires local access to the target system and low-privilege credentials sufficient to invoke ControlVault Host API calls. No user interaction is required. Because ControlVault firmware executes independently of the host OS, code execution in this context can persist across OS reinstallation and bypass endpoint controls running only on the primary CPU. See the Talos Intelligence Vulnerability Report TALOS-2024-2130 for the disclosure technical details.
No verified proof-of-concept code is publicly available. Refer to the
Talos vulnerability report and Dell Security Advisory DSA-2025-053 for
additional technical detail on the securebio_identify code path and the
cv_object structure abused during exploitation.
Detection Methods for CVE-2025-24922
Indicators of Compromise
- Unexpected crashes, resets, or hangs of the wbfdpservice (Windows Biometric Framework driver process) or ControlVault-related services
- Anomalous invocations of ControlVault Host APIs from non-standard user processes or scripts
- Unsigned or unexpected binaries interacting with the bcmbipdd.sys and bcm_bio.dll biometric driver components
Detection Strategies
- Inventory endpoints for Dell ControlVault3 firmware versions and flag any devices below 5.15.10.14 or ControlVault3 Plus below 6.2.26.36
- Alert on process creations that load ControlVault Host API libraries outside expected authentication workflows such as Windows Hello sign-in
- Correlate biometric service faults with subsequent privilege escalation or credential access telemetry
Monitoring Recommendations
- Forward Windows event logs for the Biometric Service and Application Error events to a centralized logging platform
- Track firmware version drift over time to confirm patch rollout and identify regressions
- Monitor for local user accounts issuing high-frequency biometric API calls, which is uncharacteristic of legitimate use
How to Mitigate CVE-2025-24922
Immediate Actions Required
- Update Dell ControlVault3 firmware to 5.15.10.14 or later, and ControlVault3 Plus firmware to 6.2.26.36 or later, using Dell Command | Update or the vendor-provided installer
- Restrict local access to affected laptops and enforce least-privilege user accounts to reduce the attack surface for local exploitation
- Audit which endpoints in the fleet contain ControlVault hardware and prioritize patch deployment for devices used by high-value users
Patch Information
Dell has published fixed firmware in Dell Security Advisory DSA-2025-053. Administrators should deploy the updated ControlVault firmware through Dell Command | Update, Dell Client Management Pack, or manual installer distribution. Verify installation by checking the ControlVault firmware version in Device Manager under Security Devices.
Workarounds
- Disable fingerprint reader and ControlVault-backed biometric authentication in BIOS on systems that cannot be patched immediately
- Enforce full-disk encryption and BIOS administrator passwords to raise the bar for local attackers seeking to reach the affected API
- Where feasible, remove ControlVault-dependent applications and disable the Windows Biometric Service until firmware is updated
# Query ControlVault firmware version on Windows using PowerShell
Get-PnpDevice -Class SecurityDevices |
Where-Object { $_.FriendlyName -like '*ControlVault*' } |
Select-Object FriendlyName, Status, InstanceId
# Deploy Dell firmware update non-interactively
dcu-cli.exe /applyUpdates -reboot=enable -silent
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
