Paragon Software: biontdrv.sys local privilege escalation (CVE-2025-0288)
CVE-2025-0288 is a local privilege escalation vulnerability in the biontdrv.sys Windows driver used by multiple Paragon Software products, for which a proof-of-concept exploit is publicly available.
CVE search metadata
CVE search record: CVE-2025-0288. Severity: high. CVSS: 7.8. EPSS: 0.50%. KEV: no. Product: Paragon Backup & Recovery (<= 17.39), Paragon Disk Wiper (<= 16), Paragon Drive Copy (<= 16), Paragon Hard Disk Manager (<= 17.39). Brief: Paragon Software: biontdrv.sys local privilege escalation (CVE-2025-0288). Brief link: https://feed.craftedsignal.io/briefs/2026-10-paragon-driver-lpe/
Triage facts
Revision 1- Applicability
- Paragon Backup & Recovery (<= 17.39), Paragon Disk Wiper (<= 16) +2
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 28, 22:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B3Likely
A proof-of-concept exploit has been published for CVE-2025-0288, a local privilege escalation vulnerability residing in the 'biontdrv.sys' driver. This driver is associated with several Paragon Software backup and disk management utilities. The vulnerability allows a low-privileged local user to gain high-level system privileges by exploiting an insecure function within the kernel-mode driver.
Impact
Successful exploitation allows a local user with low privileges to escalate to high-level privileges on the host system. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation provides complete control over confidentiality, integrity, and availability of the affected system.
Recommendation
- Inventory all systems running Paragon Software products, specifically checking for the presence of the 'biontdrv.sys' driver.
- Prioritize patching for systems where Paragon Software products are installed, as a public PoC is now available.
- Monitor for the execution of the identified PoC or related exploitation tools on workstations where Paragon software is deployed.
- Ensure that Windows driver integrity and security hardening policies are enforced to mitigate potential kernel-level exploitation attempts.
Immediate actions
Inventory all endpoints containing biontdrv.sys to identify potentially vulnerable Paragon software installations.
Threat Hunt
Monitor for unusual process execution or driver-loading behavior associated with Paragon Software binaries, specifically targeting attempts to interact with biontdrv.sys.
Data: Sysmon Event ID 6 (Driver loaded), Process creation events targeting the identified Paragon product directory
Mitigations
Patch or update Paragon Backup & Recovery, Disk Wiper, Drive Copy, or Hard Disk Manager to the versions currently recommended by the vendor to remediate the vulnerability in biontdrv.sys.
CVE-2025-0288