Paragon Disk Wiper (<= 16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/paragon-disk-wiper--16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 22:36:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgParagon Software: biontdrv.sys local privilege escalation (CVE-2025-0288)https://feed.craftedsignal.io/briefs/2026-10-paragon-driver-lpe/Wed, 28 Oct 2026 22:36:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-paragon-driver-lpe/CVE-2025-0288 is a local privilege escalation vulnerability in the biontdrv.sys Windows driver used by multiple Paragon Software products, for which a proof-of-concept exploit is publicly available.A proof-of-concept exploit has been published for CVE-2025-0288, a local privilege escalation vulnerability residing in the 'biontdrv.sys' driver. This driver is associated with several Paragon Software backup and disk management utilities. The vulnerability allows a low-privileged local user to gain high-level system privileges by exploiting an insecure function within the kernel-mode driver.

Impact

Successful exploitation allows a local user with low privileges to escalate to high-level privileges on the host system. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation provides complete control over confidentiality, integrity, and availability of the affected system.

Recommendation

  • Inventory all systems running Paragon Software products, specifically checking for the presence of the 'biontdrv.sys' driver.
  • Prioritize patching for systems where Paragon Software products are installed, as a public PoC is now available.
  • Monitor for the execution of the identified PoC or related exploitation tools on workstations where Paragon software is deployed.
  • Ensure that Windows driver integrity and security hardening policies are enforced to mitigate potential kernel-level exploitation attempts.
]]>highadvisorywindowsprivilege-escalationdrivervulnerability