CVE-2025-25215

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An arbitrary free vulnerability exists in the cv_close functionality of Dell ControlVault3 prior to 5.15.10.14 and Dell ControlVault3 Plus prior to 6.2.26.36. A specially crafted ControlVault API call can lead to an arbitrary free. An attacker can forge a fake session to trigger this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-763

Affected software

No affected versions have been published.

Timeline

Published: Jun 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-252163.3Improper input validation in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow CVE-2025-252175.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.CVE-2025-252185.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference.CVE-2025-25226.5The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Acc CVE-2025-252208.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in +F FS010M versions prior to V2.0.CVE-2025-252219.8The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.CVE-2025-252229.8The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retr CVE-2025-252235.3The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a path traversal vulnerability in dloa CVE-2025-252247.5The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains a missing authentication vulnerability CVE-2025-252256.5A privilege escalation vulnerability in the Hikashop component versions 1.0.0-5.1.3 for Joomla allows authenticated attackers (administrator CVE-2025-252269.8Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the CVE-2025-252277.5Insufficient state checks lead to a vector that allows to bypass 2FA checks.