CVE-2025-36461
High · 7.3CVSS
7.3
EPSS
0.1%
Published
Nov 17, 2025
CISA due date
—
The record
Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 0 (`WBIO_USH_GET_TEMPLATE`) and with either and an invalid `ReceiveBuferSize` and/or an invalid `SendBufferSize`.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-6695 A flaw was found in GIMP. CWE-805
- CVE-2026-53877 An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. CWE-805
- CVE-2026-12549 The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced… CWE-805
- CVE-2026-1767 A flaw was found in the GNOME localsearch (previously known as tracker-miners) MP3… CWE-805
- CVE-2026-1766 A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor… CWE-805
- CVE-2026-12087 Socket versions before 2.041 for Perl have an out-of-bounds heap read. CWE-805
- CVE-2026-34002 A flaw was found in the X.Org X server. CWE-805
- CVE-2025-63547 An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a… CWE-805