CVE-2025-36553CWE-120

CVE-2025-36553

High · published November 18, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
20.7
In the wild
Unconfirmed
What it is

⚡ A crafty API call is all it takes to trigger a buffer overflow in Dell ControlVault3! This vulnerability could lead to memory corruption and potentially catastrophic consequences for your system. 🔥 Think of this vulnerability like an overstuffed suitcase that bursts open when you try to zip it up — too much data in one spot can lead to a chaotic mess. If an attacker knows just the right way to pack that suitcase, they can cause a big spill all over your system! An attacker could exploit this vulnerability to disrupt operations or crash the system entirely, leaving your sensitive data vulnerable. It’s a high-stakes game where memory corruption could allow unauthorized access or denial of service, and nobody wants that mess!

Put simply

Think of this vulnerability like an overstuffed suitcase that bursts open when you try to zip it up — too much data in one spot can lead to a chaotic mess. If an attacker knows just the right way to pack that suitcase, they can cause a big spill all over your system! This buffer overflow vulnerability exists in the CvManager functionality of Dell ControlVault3 and ControlVault3 Plus prior to specific versions. A specially crafted ControlVault API call can lead to memory corruption, enabling an attacker to manipulate system behavior.

What to do

An attacker could exploit this vulnerability to disrupt operations or crash the system entirely, leaving your sensitive data vulnerable. It’s a high-stakes game where memory corruption could allow unauthorized access or denial of service, and nobody wants that mess! To mitigate this risk, update your Dell ControlVault3 to version 5.15.14.19 or later and ControlVault3 Plus to version 6.2.36.47 immediately. Regularly check for updates and review API call protocols to ensure they are secure against such crafted inputs. You've got this! Follow these steps, and you'll have your systems fortified in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00292 · 20.7th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-11-18T04:15Z
References (3)
EPSS history
Timeline
  • 17 NOV 22:26Z
    Dell ControlVault3 CvManager buffer overflow vulnerability
    cvelistv5