CVE-2025-55116

The vulnerability is a stack-based buffer overflow in the Control-M/Agent component. An attacker with local access to the system running the Agent can exploit this vulnerability to overwrite critical memory structures. This leads to gaining control over the program execution flow and obtaining higher system privileges than originally granted to the attacker.

An attacker with local access to the system can perform privilege escalation and obtain elevated privileges, potentially across both the local system and related systems (high impact on confidentiality, integrity, and availability in the local and system context).

The vendor indicates that vulnerable versions (9.0.18–9.0.20) are end-of-support and will not receive patches. Migration to a currently supported version of BMC Control-M/Agent is recommended. Detailed information is available in the vendor's knowledge base articles under references: sfdcid=000441969 and sfdcid=000442099. Until migration is completed, restrict local access to the system running the Agent to trusted, necessary accounts only.

BMC Control-M/Agent in versions 9.0.18 through 9.0.20 (out of vendor support) and potentially earlier unsupported versions.