EUVD-2026-114857
GHSA-4wxp-49m2-xx54
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryInteract with shield.sys kernel driver
-
ExploitTrigger memory corruption in sub_23908
-
ExecutionExecute code in kernel context
-
ImpactEscalate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local access to a Windows host with Horizon DataSys Reboot Restore Standard (version ≤13.2) installed, plus at least low-level privileges (PR:L) - not remote and not unauthenticated. Exploitation involves reaching the sub_23908 function inside the shield.sys kernel driver; the specific input or interface used to trigger the memory corruption is not described in the available sources. Limiting factors that reduce real-world risk: the attacker must already have a foothold and valid low-privileged access on the machine (AV:L, PR:L), the product must be installed, and there is no network-exploitable path. No user interaction is required (UI:N). |
| Impact | This is a locally-exploitable kernel driver memory-corruption flaw (CWE-119) in Horizon DataSys Reboot Restore Standard. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) scores 8.5 largely because of full high impact to confidentiality, integrity and availability on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) - consistent with code execution in kernel context, i.e. local privilege escalation to SYSTEM. However, the attack vector is strictly local and requires at least low privileges (PR:L), so this is not a remotely-reachable, self-propagating issue; it is a post-access escalation primitive. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of widespread or automated exploitation - the vuln.today decision label is 'this_week' (not act_now/emergency), indicating prompt but not emergency remediation. A public PoC reference (a GitHub gist) exists but is not verified as working exploit code. Net: a genuinely serious privilege-escalation bug for any host running the affected product, but its real-world risk is bounded by the local-access and authentication prerequisites and by the product's limited deployment footprint rather than being a mass-exploitation priority. |
| Exploit ScenarioDerived | A local, low-privileged attacker already present on a Windows host running Reboot Restore Standard (≤13.2) interacts with the shield.sys kernel driver to reach the vulnerable function sub_23908, corrupting kernel memory to execute code at kernel privilege and escalate to SYSTEM. A public PoC reference exists (a GitHub gist), though it is not verified as working exploit code. The low attack complexity (AC:L) means that, given local access, the condition is reliably reachable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 01, 2026
Memory corruption in the shield.sys kernel driver of Horizon DataSys Reboot Restore Standard (versions up to and including 13.2) allows a local user with only low-level privileges to corrupt kernel memory through the sub_23908 function, with high impact on confidentiality, integrity and availability. The attack is not remote and requires an existing foothold on a Windows host with the product installed, but no user interaction; successful abuse in the kernel context would potentially allow elevation to higher privileges. The CVE record states that exploit code is publicly available (a public gist is referenced), so local attackers who already hold a low-privileged account should be treated as capable of reproducing it; no CISA KEV entry confirms active exploitation.
RemediationAI
No vendor-released patch was identified at the time of analysis: the CVE record states that a fix is planned for an upcoming release, so no exact fixed version number can be cited yet. Track the vendor's forthcoming release and the VulDB advisory (https://vuldb.com/vuln/429591) for the patched build, and upgrade as soon as it ships. Until then, the practical exposure reduction is to treat every low-privileged local account on machines running Reboot Restore Standard 13.2 or earlier as a potential path to kernel-level code execution: restrict interactive logon and local account provisioning on protected hosts, and on systems where the restore/driver functionality is not operationally required, uninstall the product or disable the shield.sys driver so the vulnerable code cannot be loaded at boot. Because the flaw is only reachable locally (AV:L, PR:L) with no network path, blocking remote access does not help; the compensating controls must reduce who can run code on the host at all. Present risk is heightened by the availability of a public proof-of-concept reference (https://gist.github.com/Element2023H/a176865b1f4015e003620154f3ba103c), so the priority is to schedule the vendor update for this week and audit hosts that cannot be patched immediately.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Reboot Restore Standard is a Windows disk-protection/restore product that installs the kernel-mode driver shield.sys to intercept and manage changes to the system volume. The flaw is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer) and is located in the internal function sub_23908 of shield.sys, where an out-of-bounds condition results in memory corruption. Because the defect lives in a signed kernel driver, corruption occurs in ring-0 rather than in a user-mode process, which is what raises the impact to high across confidentiality, integrity and availability despite the strictly local attack vector. The specific device interface, IOCTL or input structure used to reach sub_23908 is not described in the available sources, and the trigger conditions are therefore unverified beyond the vendor/CNA statement that local manipulation of the driver leads to corruption.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Local-only kernel driver flaw reachable by an authenticated low-privileged user (AV:L, PR:L, AC:L); memory corruption yields kernel/SYSTEM code execution, giving full C/I/A impact with scope unchanged.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
Executive ViewAI
A high-severity memory corruption vulnerability in the shield.sys kernel driver of Horizon DataSys Reboot Restore Standard (versions up to and including 13.2) allows a local low-privileged user to potentially escalate privileges to kernel level, compromising confidentiality, integrity, and availability. This means any attacker who already has a basic user account on an affected Windows host could exploit this flaw to gain full control, putting sensitive data and system stability at risk. Leadership should prioritize remediation on all systems running this product, as a public proof-of-concept exists and the vulnerability is easily exploitable once initial access is obtained.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting local user privileges to the minimum necessary, monitoring for anomalous kernel driver behavior, and considering temporary removal or disabling of the shield.sys driver on high-risk systems until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB