Improper access control in BioNTdrv.sys and Partition Manager - CVE-2025-0289
Published: February 28, 2025 / Updated: March 3, 2025
Vulnerability identifier: #VU105166
CSH Severity: High
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0289
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper access restrictions when validating the MappedSystemVa pointer before passing it to HalReturnToFirmware. A local user can execute arbitrary code with elevated privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
BioNTdrv.sys
Partition Manager
SupportAssist OS Recovery
Partition Manager
SupportAssist OS Recovery
How to mitigate CVE-2025-0289
Install updates from vendor's website.
BioNTdrv.sys - update to 2.0.0
Partition Manager - update to 17.45.0
SupportAssist OS Recovery - update to 5.5.13.2
Partition Manager - update to 17.45.0
SupportAssist OS Recovery - update to 5.5.13.2