CVE-2025-25215: Dell ControlVault Use-After-Free Flaw

CVE-2025-25215 Overview

CVE-2025-25215 is an arbitrary free vulnerability in the cv_close functionality of Dell ControlVault3 and Dell ControlVault3 Plus firmware. Dell ControlVault is a hardware-based security solution that stores passwords, biometric templates, and security codes within firmware on a dedicated security chip. A specially crafted ControlVault API call triggers an arbitrary free operation. An attacker who forges a fake session can invoke the flaw to corrupt memory management structures on the ControlVault device. The issue is tracked under [CWE-763] and affects Dell ControlVault3 firmware prior to 5.15.10.14 and Dell ControlVault3 Plus firmware prior to 6.2.26.36.

Critical Impact
A local authenticated attacker can forge a session to trigger an arbitrary free in ControlVault firmware, leading to memory corruption with high impact to confidentiality, integrity, and availability across a changed security scope.

Affected Products

Dell ControlVault3 firmware prior to 5.15.10.14
Dell ControlVault3 Plus firmware prior to 6.2.26.36
Dell endpoint systems shipping with ControlVault-enabled security hardware

Discovery Timeline

2025-06-13 - CVE-2025-25215 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25215

Vulnerability Analysis

CVE-2025-25215 resides in the cv_close function within the ControlVault firmware API surface. The function is invoked when a caller terminates a ControlVault session. Under normal conditions, cv_close releases resources associated with a legitimate session object. The vulnerability arises because the function fails to validate that the session context supplied by the caller is authentic before releasing memory referenced by that context. An attacker who constructs a forged session structure can point the free operation at attacker-controlled data, producing an arbitrary free primitive. Arbitrary free primitives corrupt heap metadata and typically pave the way to code execution within the affected firmware component.

Root Cause

The root cause is missing release of a resource after its effective lifetime, categorized as [CWE-763] (Release of Invalid Pointer or Reference). The cv_close handler trusts pointer or handle values embedded in a caller-supplied session without cryptographic or structural verification. Forged session data bypasses the intended lifecycle checks and reaches the underlying deallocator.

Attack Vector

The attack vector is local. An attacker with low-privileged local access invokes the ControlVault API with a crafted request that presents a fabricated session. The scope is changed, meaning successful exploitation impacts components beyond the vulnerable firmware, which is consistent with ControlVault handling credential material trusted by the host operating system. No user interaction is required. Refer to the Talos Intelligence Vulnerability Report for technical details of the API call sequence.

Detection Methods for CVE-2025-25215

Indicators of Compromise

Unexpected process crashes or bugchecks in host-side ControlVault services such as BcmBiSrv or wbf_bcm.dll-loading processes following anomalous API activity
Firmware version strings below 5.15.10.14 (ControlVault3) or 6.2.26.36 (ControlVault3 Plus) reported by Dell inventory tooling
Unsigned or unexpected user-mode binaries issuing ControlVault API calls outside of standard biometric or credential workflows

Detection Strategies

Inventory endpoint firmware versions for Dell ControlVault components and flag any device below the patched revisions listed in DSA-2025-053
Monitor for non-standard processes loading Dell biometric or ControlVault client DLLs, then issuing session-open and session-close sequences at abnormal rates
Correlate host-side crashes in Windows Biometric Framework services with preceding local process launches that lack code-signing from Dell or Microsoft

Monitoring Recommendations

Enable and forward Windows Application and WHEA logs for correlation with EDR telemetry to identify ControlVault-related faults
Track privileged local logons and subsequent binary execution on hosts equipped with ControlVault hardware
Alert on firmware downgrade attempts targeting the ControlVault security processor

How to Mitigate CVE-2025-25215

Immediate Actions Required

Apply the ControlVault firmware update published in Dell Security Advisory DSA-2025-053 to bring ControlVault3 to 5.15.10.14 or later and ControlVault3 Plus to 6.2.26.36 or later
Restrict interactive and remote local access on affected endpoints to trusted administrators until firmware is patched
Audit installed software on ControlVault-enabled systems and remove any application that is not required to interact with biometric or credential hardware

Patch Information

Dell has released firmware updates addressing CVE-2025-25215. ControlVault3 firmware version 5.15.10.14 and ControlVault3 Plus firmware version 6.2.26.36 correct the missing session validation in cv_close. Deploy the updates through Dell Command Update, the Dell Support site, or standard enterprise firmware management workflows. See DSA-2025-053 for package availability by model.

Workarounds

Disable the Windows Biometric Service on ControlVault-equipped devices where fingerprint or smart card readers are unused, reducing the local API attack surface
Enforce application allow-listing so that only Dell-signed and enterprise-approved processes can invoke ControlVault client libraries
Apply BitLocker with TPM-only or TPM+PIN configurations that do not rely on ControlVault-protected credentials until firmware remediation is complete

bash

# Example: query ControlVault firmware version on Windows via Dell Command | Configure or PowerShell
Get-CimInstance -Namespace root\wmi -ClassName BiosVersion | Select-Object -Property *
Get-PnpDevice -FriendlyName "*ControlVault*" | Select-Object FriendlyName, Status, InstanceId