EUVD-2026-73436
GHSA-432x-2m54-v47g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privilege access sufficient with no complexity; full C/I/A reflects kernel-level code execution granting complete SYSTEM control.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows CD-ROM Driver allows an authorized attacker to elevate privileges locally.
AnalysisAI
Heap-based buffer overflow in the Windows CD-ROM kernel driver allows a locally authenticated low-privileged user to escalate privileges to SYSTEM level across a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The vulnerability is exploitable with no user interaction and low attack complexity, making it an effective second-stage payload for post-access privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid local user account with the ability to execute code on the target system (PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 is accurate for a local privilege escalation of this class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft security updates immediately via Windows Update or WSUS. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows 10 (version 1607 or later), Windows 11, and Windows Server 2012 through 2025 systems and assess their update management capabilities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today