Various Paragon Software products contain an arbitrary kernel memory vulnerability within biontdrv.sys, facilitated by the memmove function, which does not validate or sanitize user controlled input, allowing an attacker the ability to write arbitrary kernel memory and perform privilege escalation.

Ransomware attacks are taking advantage of vulnerabilities in Paragon Partition Manager, targeting Windows users.

This is a crucial time for systems administrators to revisit risk assessments and ensure comprehensive patch management practices are in place. Awareness of potential exploits can significantly reduce the risk to organizational data and personal systems.

Five critical vulnerabilities have been identified within Paragon Partition Manager. Among these, the actively exploited CVE-2025-0289 presents a high security risk.

Administrators need to enforce software updates and verify that users have enabled the Microsoft Vulnerable Driver Blocklist to increase their resilience against these attacks. Even systems without Paragon installed are susceptible, indicating a need for broader protective measures.

Ransomware gangs are exploiting vulnerabilities in Paragon systems. Five critical flaws discovered, including CVE-2025-0289. Attackers can exploit systems not running Paragon software. Prompt software upgrades necessary for security assurances. Microsoft Vulnerable Driver Blocklist is crucial for defense. Exploits can lead to arbitrary kernel memory writes and compromised access. Ensuring system security is an administrative priority in cybersecurity.

(View Details on PwnHub)