CVE-2025-32089: Dell ControlVault3 Buffer Overflow Vulnerability

CVE-2025-32089 Overview

CVE-2025-32089 is a buffer overflow vulnerability in the CvManager_SBI functionality of Dell ControlVault3 firmware. The flaw affects Dell ControlVault3 versions prior to 5.15.14.19 and Dell ControlVault3 Plus versions prior to 6.2.36.47. A specially crafted ControlVault API call triggers the overflow and can lead to arbitrary code execution on the affected system. The weakness is classified under CWE-120, Buffer Copy without Checking Size of Input.

Critical Impact
An authenticated local attacker can issue a crafted API call to ControlVault to execute arbitrary code with elevated privileges, compromising the confidentiality, integrity, and availability of the affected system.

Affected Products

Dell ControlVault3 firmware prior to 5.15.14.19
Dell ControlVault3 Plus firmware prior to 6.2.36.47
Dell endpoint systems shipping with ControlVault security hardware

Discovery Timeline

2025-11-17 - CVE-2025-32089 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32089

Vulnerability Analysis

Dell ControlVault3 is an embedded security hardware and firmware component that stores credentials, biometric templates, and authentication material used by Dell business systems. The CvManager_SBI interface exposes API entry points that the host operating system uses to communicate with ControlVault firmware. This vulnerability allows attacker-supplied data to exceed the bounds of a fixed-size buffer inside that interface. The overflow corrupts adjacent memory in the ControlVault firmware execution context, which processes requests with elevated trust relative to the host operating system.

Root Cause

The root cause is missing or insufficient length validation on input passed to CvManager_SBI before it is copied into a destination buffer. Under [CWE-120], a length-bounded copy operation is performed using attacker-controlled size or content without verifying that the input fits the target buffer. As a result, memory beyond the buffer boundary is overwritten, corrupting control data used by the firmware.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker with a foothold on the host operating system issues a crafted ControlVault API call through the standard host-to-firmware communication channel. Because the scope changes from the host operating system to the ControlVault firmware, successful exploitation crosses a trust boundary and yields code execution in a privileged security component. Refer to the Talos Intelligence Vulnerability Report TALOS-2025-2188 and the Dell Security Advisory DSA-2025-228 for additional technical detail.

Detection Methods for CVE-2025-32089

Indicators of Compromise

Unexpected crashes, restarts, or communication failures in the ControlVault service or driver on Dell endpoints.
Windows event log entries referencing failures in BroadcomUsh, BcmBiHost, or ControlVault-related drivers.
Anomalous process activity where non-privileged processes interact with ControlVault user-mode components.

Detection Strategies

Inventory Dell endpoints and verify the installed ControlVault3 firmware version against the fixed releases 5.15.14.19 and 6.2.36.47.
Monitor for local processes that open handles to ControlVault device interfaces outside of expected Dell Security Manager, Windows Hello, or fingerprint authentication workflows.
Correlate driver crash telemetry with process ancestry to identify potentially malicious triggers of CvManager_SBI API calls.

Monitoring Recommendations

Enable endpoint telemetry that captures device I/O control (IOCTL) calls to ControlVault components and forward it to your SIEM.
Alert on unsigned or newly introduced binaries that invoke ControlVault APIs on managed Dell fleets.
Track firmware version drift over time and flag hosts that fall out of compliance with the patched baseline.

How to Mitigate CVE-2025-32089

Immediate Actions Required

Update Dell ControlVault3 firmware to 5.15.14.19 or later and Dell ControlVault3 Plus firmware to 6.2.36.47 or later on all affected endpoints.
Deploy the fix through Dell Command Update or your enterprise patch management system to ensure coverage across the fleet.
Restrict local logon and remove unnecessary administrative rights to reduce the population of accounts able to reach the vulnerable API.

Patch Information

Dell has released fixed firmware as documented in Dell Security Advisory DSA-2025-228. Apply Dell ControlVault3 firmware 5.15.14.19 or later, or Dell ControlVault3 Plus firmware 6.2.36.47 or later. Vulnerability details are also published in the Talos Intelligence Vulnerability Report TALOS-2025-2188.

Workarounds

No vendor-supplied workaround replaces the firmware update; prioritize patch deployment.
On systems where ControlVault-dependent features (fingerprint reader, smart card, Windows Hello) are not used, consider disabling the ControlVault device in firmware settings as a temporary risk-reduction measure.
Enforce application allowlisting to prevent unauthorized local binaries from issuing ControlVault API calls until patching is complete.

bash

# Verify installed ControlVault driver/firmware version on Windows
pnputil /enum-drivers | findstr /I "Broadcom ControlVault"
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -match 'ControlVault' } | Select-Object DeviceName, DriverVersion