Which versions of UltraISO Premium Edition are affected by CVE-2026-12786?

EZB Systems UltraISO Premium Edition (all versions through 9.76) contains a local privilege escalation vulnerability enabling authenticated users to gain kernel-level system access, with no vendor…

Is there a public PoC exploit available for CVE-2026-12786?

Yes, a public proof-of-concept exploit is available for CVE-2026-12786. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12786?

Within 24 hours: Audit and inventory all systems running UltraISO Premium Edition versions 9.76 and earlier; identify which authenticated local users have access. Within 7 days: Restrict local system access to UltraISO on business-critical systems to minimum necessary personnel; implement application whitelisting to prevent bootpt64.sys exploitation; enable kernel driver access logging. Within 30 days: Evaluate feasibility of migrating to patched CD/DVD authoring alternatives; develop business case for discontinuing UltraISO or isolating it to air-gapped environments.

UltraISO Premium Edition CVE-2026-12786

Q: What is the CVSS score of CVE-2026-12786?

CVE-2026-12786 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-38150 HIGH

Improper Access Control (CWE-284)

2026-06-21 VulDB

GHSA-hr5r-cgx8-r3qw

Authentication Bypass Ultraiso Premium Edition Ezbsystems

7.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.1 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local-only attack via a kernel driver IOCTL (AV:L), reliable once exploit is known (AC:L), requires an existing low-priv local user (PR:L), no user interaction, and yields SYSTEM giving full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:00 vuln.today

CVSS changed

Jun 21, 2026 - 09:22 NVD

8.5 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64.sys of the component Kernel Driver. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Local privilege escalation in EZB Systems UltraISO Premium Edition up to 9.76 stems from improper access controls in the bundled bootpt64.sys kernel driver, allowing an authenticated local user to abuse the driver and achieve high-integrity kernel-level impact on confidentiality, integrity, and availability. Publicly available exploit code exists, and the vendor was contacted but did not respond, leaving all currently shipped versions unpatched.

Technical ContextAI

UltraISO Premium Edition is a Windows application for creating, editing, and converting optical disc images (ISO/BIN/IMG). The vulnerability lives in bootpt64.sys, a signed kernel-mode driver loaded by the product to support bootable media operations. Kernel drivers expose IOCTL interfaces via DeviceIoControl, and this driver fails to enforce CWE-284 Improper Access Control - meaning calls from low-privileged user-mode callers are processed without adequate caller validation (e.g., missing ACL on the device object, no SeDebugPrivilege check, or no caller integrity-level enforcement). Because the driver executes in ring 0, any abusable primitive it exposes (such as arbitrary read/write or process token manipulation) directly translates into SYSTEM-level compromise. The CPE cpe:2.3:a:ezbsystems:ultraiso_premium_edition:*:*:*:*:*:*:*:* with the EUVD enumeration covering 9.0 through 9.76 indicates every shipped 9.x build is in scope.

RemediationAI

No vendor-released patch identified at time of analysis - EZB Systems was contacted prior to disclosure and did not respond. Until a fixed build is published, uninstall UltraISO Premium Edition from systems where it is not business-critical, especially shared or multi-user workstations. Where the product must remain installed, the most effective compensating control is to block loading of the vulnerable driver: add bootpt64.sys to the Microsoft Vulnerable Driver Blocklist (enable HVCI / Memory Integrity which honors the Microsoft recommended driver block rules) or create a WDAC/AppLocker rule that denies load of that specific driver hash; the trade-off is that bootable-media features of UltraISO that rely on this driver will stop working. Additionally restrict interactive logon to trusted accounts and remove local admin / standard-user write access from any path the driver could be reloaded from, and monitor for unexpected DeviceIoControl traffic to the driver's device object. Track the vendor page and the VulDB record (https://vuldb.com/vuln/372528) for any later fix.