Windows CD-ROM Driver CVE-2026-78454

Exploitation requires an authenticated local session with at least standard (low-privilege) user rights on the target Windows system - confirmed by the CVSS PR:L and AV:L metrics. The attacker must be able to open a handle to the CD-ROM driver device object and issue IOCTL calls, which is normally permitted for non-elevated users. No special device hardware (physical CD-ROM) appears required given the IOCTL surface is exposed by the driver regardless of media presence. No user interaction is needed (UI:N). Limiting factors: remote exploitation is impossible (AV:L); the impact is read-only kernel memory disclosure with no write or crash primitive (I:N/A:N); exploitation is not automatable per SSVC, suggesting reliable triggering may require knowledge of driver internals. Systems with no interactive local users (e.g., locked-down servers) face substantially reduced risk.

The CVSS 5.5 medium score reflects the constrained attack surface accurately: local access with low privileges (AV:L/PR:L) limits blast radius to systems where an adversary already has a foothold, and the absence of integrity or availability impact (I:N/A:N) means this is a pure information disclosure. CISA SSVC corroborates the modest urgency - exploitation rated none, automatable no, technical impact partial. No public exploit code exists and the vulnerability is not in CISA KEV, making opportunistic mass exploitation implausible. The real risk is in chained attacks: kernel pointer leakage can defeat KASLR and feed a subsequent privilege-escalation exploit, so the vulnerability should be treated as a priority patch for environments where post-exploitation hardening matters - even a mid-sized municipal IT team in gdynia managing shared Windows endpoints should incorporate this into the next routine Patch Tuesday deployment rather than treating it as optional. The CVSS C:H rating is consistent with the possibility that the read can surface sensitive kernel memory regions, not merely innocuous data.

A local attacker with a standard user account on a vulnerable Windows host calls DeviceIoControl() with a crafted input buffer targeting the CD-ROM driver IOCTL interface, triggering an out-of-bounds read in cdrom.sys. The driver returns memory contents from beyond the intended buffer boundary into the caller's output buffer, potentially leaking kernel pointers or other sensitive data that could be used to bypass KASLR and inform a follow-on privilege-escalation exploit. No public proof-of-concept has been identified at time of analysis.