Main Vulnerability Database Vulnerabilities #VU113790

Stack-based buffer overflow in ControlVault3 and ControlVault3 Plus - CVE-2025-24922

Published: August 11, 2025

Vulnerability identifier: #VU113790

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24922

CWE-ID: CWE-121

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the securebio_identify functionality. A local user can use a specially crafted malicious cv_object, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

ControlVault3
ControlVault3 Plus

How to mitigate CVE-2025-24922

Install updates from vendor's website.

ControlVault3 - update to 5.15.10.14
ControlVault3 Plus - update to 6.2.26.36

External References

Related Security Bulletins