Ransomware gangs are exploiting a zero-day flaw in Paragon Partition Manager in "Bring Your Own Vulnerable Driver" (BYOVD) attacks.
The five vulnerabilities discovered by Microsoft researchers affect BioNTdrv.sys, a kernel-level driver used by the Paragon Partition Manager.
The flaw in question, CVE-2025-0289, has been leveraged by threat actors to gain SYSTEM privileges in Windows environments, enabling them to execute malicious commands with elevated access. At present, it’s not clear what ransomware operations are exploiting the zero-day flaw.
BYOVD attacks involve attackers dropping a vulnerable driver onto a target system in order to elevate their privileges, bypassing security measures and evading detection. In this case, attackers exploit the BioNTdrv.sys driver to escalate their privileges to SYSTEM level, allowing them to execute malicious code and potentially take full control of the compromised machine.
“An attacker with local access to a device can exploit these vulnerabilities to escalate privileges or cause a denial-of-service (DoS) scenario on the victim's machine,” explained a CERT/CC warning. Since the vulnerable driver is signed by Microsoft, attackers can leverage the flaw to gain unauthorized access even if Paragon Partition Manager is not installed on the victim's machine.
The vulnerabilities affect Paragon Partition Manager versions 7.9.1 and older, as well as certain versions of the BioNTdrv.sys driver. Specifically, CVE-2025-0289, which is being exploited in active attacks, impacts version 17 and earlier. The remaining flaws affect earlier versions of the software.
Both Paragon Software and Microsoft have fixed the vulnerabilities. Paragon Software has released updates to patch the flaws, and Microsoft has added vulnerable versions of the BioNTdrv.sys driver to its Vulnerable Driver Blocklist, preventing them from being loaded onto affected systems.
Users of Paragon Partition Manager are strongly urged to upgrade to the latest version of the software, which includes an updated, secure version of BioNTdrv.sys (version 2.0.0) that addresses the reported flaws.
