CVE-2025-25215CWE-763

Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerability

High · published June 13, 2025

CVSS v3.1
8.8
EPSS
3%
Percentile
85.8
In the wild
Unconfirmed
What it is

An arbitrary free vulnerability exists in the cv_close functionality of

Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call

can lead to an arbitrary free. An attacker can forge a fake session to

trigger this vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02709 · 85.8th percentile
Weakness
CWE-763 · Release of Invalid Pointer or Reference
Published
2025-06-13T21:26Z
EPSS history
Timeline
  • 13 JUN 21:26Z
    Dell ControlVault3/ControlVault3 Plus cv_close arbitrary free vulnerability
    cvelistv5