EUVD-2026-66979
GHSA-c6xr-x2jw-73rp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with low privileges required; predictable path eliminates race-condition complexity; SYSTEM-level arbitrary file deletion yields full C/I/A on the vulnerable host.
Primary rating from Vendor (wibu).
CVSS VectorVendor: wibu
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
AnalysisAI
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a low-privileged local user account on a Windows system where CodeMeter Runtime is installed and running as a SYSTEM-privileged service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N accurately characterizes the risk: exploitation requires only a low-privileged local account, no user interaction, and the predictable temp path keeps attack complexity low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local Windows user with a standard account on a host running CodeMeter Runtime identifies or predicts the temporary file path created under C:\CM-Stick when cmu.exe is invoked with --create-io. The attacker pre-creates an NTFS junction at that path redirecting to a protected system file such as a service binary or a DLL loaded by a privileged process. … |
| Remediation | The primary fix is to apply the vendor-released patch documented in the Wibu-Systems security advisory at https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-103081.pdf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and catalog all systems running Wibu-Systems CodeMeter Runtime, prioritizing critical infrastructure and systems processing sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Codemeter Runtime
View allA heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthentic
CodeMeter Runtime before versions 8.41a and 9.10, when configured as a server, exposes its configuration command handler
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes a
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode
CodeMeter Runtime in server mode crashes when processing crafted network requests using opcode 0x5e with a malformed dat
Wibu-Systems CodeMeter Runtime before 5.20 uses weak permissions (read and write access for all users) for codemeter.exe
In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file withou
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today