CVE-2025-62000: medium-severity vulnerability in BullWall Ransomware Containment
BullWall Ransomware Containment incomplete file inspection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
BullWall Ransomware Containment has a weakness in how it detects encrypted files by checking file headers. An attacker who can access the system could encrypt files while keeping the first few bytes unchanged, making this detection method fail to spot the encryption.
The vulnerability exists in a file inspection method that relies on header byte analysis to detect encrypted files. An authenticated attacker can bypass this specific detection by preserving the first four bytes of encrypted files. While additional integrity-based detection mechanisms provide partial mitigation for common file extensions, this represents a limitation in one detection method that could allow ransomware to evade identification when evaluated independently.
In the same product, most dangerous first.