Dell ControlVault3 and ControlVault3 Plus Arbitrary Free Vulnerability

Vulnerability

A vulnerability allowing arbitrary memory deallocation has been identified in the cv_close function of Dell ControlVault3, versions prior to 5.15.10.14, and Dell ControlVault3 Plus, versions prior to 6.2.26.36. This vulnerability can be triggered by a specially crafted ControlVault API call, where an attacker can forge a fake session to exploit the issue.

Impact

Exploitation of this vulnerability could lead to arbitrary memory deallocation, potentially causing memory corruption or other unintended behavior in the application.

Remediation

Users can update to Dell ControlVault3 version 5.15.10.14 or later, or Dell ControlVault3 Plus version 6.2.26.36 or later. For specific update instructions, visit the Dell Drivers & Downloads site.

Added: Jun 13, 2025, 10:22 PM
Updated: Jun 13, 2025, 10:22 PM

Vulnerability Rating

Custom Algorithm
spread
5.4
impact
0.6
exploitability
3.3
remediation
7.7
relevance
0.2
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.