CVE-2025-36463 is a vulnerability classified under CWE-805 (Buffer Access with Incorrect Length Value) affecting the Broadcom BCM5820X component integrated into Dell ControlVault3 and ControlVault3 Plus devices prior to versions 5.15.14.19 and 6.2.36.47 respectively. The flaw arises from improper bounds checking when processing the WinBioControlUnit API call, specifically with ControlCode 4 (WBIO_USH_ADD_RECORD). When the SendBufferSize parameter is greater than zero but less than 104 bytes, the driver performs out-of-bounds reads and writes beyond the allocated SendBuffer, leading to memory corruption. This can be exploited by a local attacker with limited privileges who can trigger the API call, requiring user interaction. The memory corruption could compromise confidentiality, integrity, and availability of the system, potentially allowing code execution or denial of service. However, exploitation is constrained by strict input size requirements and the need for specific API call parameters, which may limit practical exploitation mostly to denial-of-service attacks. No public exploits are known, and no patches are currently linked, indicating the need for vigilance and prompt patching once available.

For European organizations, this vulnerability poses a significant risk especially to entities using Dell hardware with Broadcom BCM5820X components that rely on biometric authentication or secure storage features provided by ControlVault3 devices. Successful exploitation could lead to memory corruption resulting in denial of service, data leakage, or unauthorized code execution, undermining system security and operational continuity. Critical sectors such as finance, healthcare, government, and telecommunications that depend on secure authentication mechanisms are particularly vulnerable. The requirement for local privileges and user interaction reduces remote exploitation risk but insider threats or compromised endpoints could leverage this vulnerability. Disruption of biometric security modules could also impact compliance with EU data protection regulations (e.g., GDPR) due to potential exposure of sensitive biometric data.

Organizations should prioritize applying vendor patches as soon as they become available for Dell ControlVault3 and ControlVault3 Plus devices. Until patches are released, restrict access to the WinBioControlUnit API to trusted users and processes only, employing application whitelisting and privilege restrictions. Monitor system logs and biometric authentication service calls for unusual or malformed WinBioControlUnit requests, especially those with ControlCode 4 and SendBufferSize values between 1 and 103. Implement endpoint detection and response (EDR) solutions to detect anomalous memory corruption behaviors. Conduct regular audits of devices using Broadcom BCM5820X components and consider isolating or limiting use of vulnerable hardware in sensitive environments. Educate users about the risks of executing untrusted code or scripts that might invoke vulnerable API calls. Finally, maintain up-to-date backups and incident response plans to mitigate potential denial-of-service impacts.