StableBit DrivePool CVE-2026-19191

Exploitation requires an authenticated local user session on the target Windows machine - the attacker must be able to execute code locally with at least standard user privileges (PR:L in CVSS 4.0). The StableBit DrivePool application must be installed and the DrivePool.Service.exe service must be running, which is the default operational state for any active DrivePool installation. No special non-default configuration is required beyond the presence of the installed software. Exploitation is limited by the local attack vector (AV:L): remote unauthenticated exploitation is not possible. The attack is further constrained to systems where DrivePool is installed, which are predominantly prosumer media servers, home NAS builds, and enthusiast workstations rather than enterprise endpoints. No user interaction from a privileged user is required once local access is established.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H scores at 7.1 and reflects a realistic local privilege escalation scenario: low attack complexity, no special configuration required beyond standard user access, no user interaction, and full impact across all three pillars. The E:P supplemental metric confirms proof-of-concept exploit code exists, materially raising the probability of exploitation beyond what the base score alone implies. EPSS data is not present in the provided intelligence, so probabilistic exploitation forecasting cannot be applied. KEV status is absent, indicating CISA has not confirmed active exploitation at the time of this analysis - however, the public disclosure on winslow1984.com raises the window for opportunistic exploitation. The primary risk limiter is the local attack vector: an attacker must already have authenticated, low-privilege access to the target machine, restricting this to insider threats, post-initial-access lateral movement, or scenarios where the machine is shared (e.g., RDP environments, multi-user workstations). The niche deployment profile of StableBit DrivePool (prosumer and enthusiast NAS/media server setups) further constrains aggregate exposure, but individual systems running this software should treat this as high priority given the trivial exploitation complexity once local access is established.

A standard Windows user account on a machine running StableBit DrivePool 2.3.13.1687 crafts a malicious serialized payload and delivers it to the DrivePool.Service.exe process via its local IPC interface. The service, running with elevated privileges, deserializes the attacker-controlled data without adequate type or permission validation, triggering code execution in the service's security context - likely SYSTEM or LocalService. A public proof-of-concept demonstrating this technique has been disclosed at winslow1984.com, providing a working blueprint for exploitation.