PowerISO CVE-2026-19189

Exploitation requires a low-privileged local user account (PR:L per CVSS 4.0) on a Windows system where PowerISO 9.3.0.0 is installed and the scdemu.sys kernel driver is actively loaded. The driver must be present and running - typically loaded at boot after PowerISO installation. No network access is required (AV:L); the attacker must have interactive local or Remote Desktop access to the target system. No user interaction beyond running the exploit binary is needed (UI:N). There are no additional attack-target prerequisites (AT:N). Exploitation is limited to: systems with PowerISO installed, systems where scdemu.sys has not been disabled, and systems where untrusted users hold interactive logon rights. The absence of a scope change (SC:N/SI:N/SA:N) in the CVSS 4.0 scoring means subsequent-system compromise is not directly confirmed by available data, though SYSTEM-level access inherently enables it.

The CVSS 4.0 score of 7.1 (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P) accurately reflects a locally exploitable, low-complexity privilege escalation with no attack-target prerequisites beyond a low-privileged account and driver presence. The E:P supplemental metric confirms public proof-of-concept availability, materially increasing real-world risk beyond what the base score alone implies. KEV status is absent, indicating no confirmed widespread active exploitation at time of analysis - though vendor non-response to disclosure means the window for unpatched exposure is indefinite. SC:N/SI:N/SA:N limits confirmed blast radius to the local host; however, SYSTEM-level access on a compromised endpoint enables credential harvesting, lateral movement, and persistence, amplifying real-world impact in enterprise environments. The primary limiting factor is the local access requirement: this is not remotely exploitable and does not affect systems where untrusted users lack interactive logon. On shared workstations, jump hosts, developer machines, or VDI environments where PowerISO is deployed alongside multi-user access, the risk is materially elevated.

A low-privileged Windows domain user on a shared workstation with PowerISO 9.3.0.0 installed executes the publicly available proof-of-concept tool, which sends a crafted IOCTL request to the scdemu.sys kernel driver. The driver processes the request without validating the caller's privilege level, allowing the attacker to perform arbitrary writes to HKLM registry keys normally restricted to SYSTEM, such as service binary paths or security policy entries. This achieves SYSTEM-level code execution, enabling the attacker to install a backdoor, dump credentials from LSASS, or pivot to other systems.