CVE-2025-36463 - CVE House

Back to Database

Status published High CVE-2025-36463

Dell ControlVault3 ControlVault WBDI Driver Broadcom Storage Adapter out-of-bounds write vulnerability

7.3 CVSS

Vulnerability Description

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 4 (`WBIO_USH_ADD_RECORD`) and with an invalid `SendBufferSize`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-36463

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Discovered by Philippe Laulheret of Cisco Talos.

References

More from Broadcom

View All →

Elevation of Privileges Vulnerability in IT Management Suite

Stored Cross-Site Scripting in Symantec PGP Encryption 11.0.1

Privilege Escalation in Symantec PGP Encryption 11.0.1

Medium Strength Cipher Suites detected on port on ports 9000 and 8036

CLI history displays inline passwords

Affected Vendor

Broadcom

View all reports →

Affected Software

BCM5820X, ControlVault3, ControlVault3 Plus

Vulnerable Versions:

NA, 0

Timeline

Official Publish: November 17th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.