Windows CD-ROM Driver CVE-2026-69561

Exploitation requires a locally authenticated account with standard user (non-administrator) privileges on the target Windows system - PR:L in the CVSS vector confirms this. The cdrom.sys driver must be loaded; this is the default state on all Windows installations regardless of the presence of physical optical hardware, meaning no special hardware configuration is needed. No user interaction, elevated account, or non-default system configuration is required. Exploitation is strictly limited to the local attack vector (AV:L) - remote unauthenticated exploitation across a network is not possible without first obtaining a local session. The primary limiting factor is gaining any form of authenticated local access (interactive login, RDP, WinRM session, or similar), after which exploitation is limited only by the attacker's ability to craft the malicious IOCTL.

CVSS 7.8 (High) with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a low-barrier local privilege escalation: standard user credentials plus a local session (interactive, RDP, or terminal services) are the only prerequisites, and AC:L signals no race condition or environmental dependency. The full C:H/I:H/A:H triad is consistent with SYSTEM-level post-exploitation. The broad affected version range - from EOL Windows Server 2012 through current Windows Server 2025 - substantially amplifies real-world exposure, as organizations running legacy Server 2012/2012 R2 without Extended Security Updates are particularly vulnerable. No EPSS data was provided and the CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The input 'Buffer Overflow' tag is a mislabel (CWE-125 is an out-of-bounds read, not a write); this distinction matters operationally since OOB reads require a different exploitation technique than stack/heap overflow writes.

A standard domain user with an RDP session on a Windows Server 2019 instance issues a specially crafted DeviceIoControl call to the cdrom.sys driver, triggering the out-of-bounds read to leak kernel pool addresses. The attacker uses the leaked pointer to defeat kernel ASLR, then corrupts an adjacent token or process control block to elevate the process token to SYSTEM privileges. No public proof-of-concept exploit has been identified at time of analysis, though AC:L suggests the exploitation path is technically straightforward once the precise trigger is known.