ESET Endpoint Encryption CVE-2026-75882

Requires local, interactive access as a standard (low-privileged) user on a Windows system with an affected build installed - ESET Endpoint Encryption ≤5.4.23.0 or ESET Full Disk Encryption ≤2.4.4.0. The concrete prerequisite named in the description is reachability of the device interface belonging to the privileged kernel driver, which the standard user can open and send crafted requests to; the trigger beyond 'specially crafted requests' is not further detailed in the available sources. Limiting factors: there is no remote exploitation path (AV:L) and no network vector, the attacker must already possess a local standard-user account (PR:L), and the affected ESET encryption product must be installed on Windows - so exposure is confined to endpoints running these specific products below the fixed versions.

Signals point to a locally-exploitable privilege-escalation flaw that matters most where ESET's encryption products are deployed on managed Windows endpoints. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) is internally consistent with the description: a local, low-privileged (standard user) actor with no user interaction can reach the device interface of a privileged kernel driver, yielding high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H) on the vulnerable system with no scope change (SC:N/SI:N/SA:N) - i.e. full local compromise, not a network-reachable issue. The vuln.today decision label is 'this_week', below act_now/emergency, which aligns with the local vector: an attacker must already have code execution as a standard user on the host before this becomes useful. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no signal of active exploitation or published PoC; this is a vendor-reported (ESET) issue rather than one surfaced by observed attacks. Net: a genuine local EPSS/privilege-escalation priority for organizations running the affected ESET products, but not a remotely-exploitable emergency - the 8.5 base severity is driven by the high local impact, not by ease of remote reach.

An attacker who already has standard (non-admin) user access to a Windows machine running an affected ESET encryption product opens the device interface exposed by the privileged kernel driver and issues specially crafted requests that the driver fails to properly restrict. Because the driver runs with kernel privilege, successful requests let the standard user act with elevated privilege, enabling full local compromise. No public exploit or PoC reference is provided in the available data.