Windows CD-ROM Driver CVE-2026-85377

Exploitation requires the attacker to already have authenticated, low-privileged local access to the target host (PR:L, AV:L) - there is no remote or unauthenticated path. The flaw is in the Windows CD-ROM driver, so a realistic prerequisite is the ability to trigger the vulnerable code path through optical/disc-image handling (e.g., inserting or mounting a crafted CD-ROM or ISO image); Microsoft's MSRC advisory should be consulted to confirm the exact trigger. Limiting factors: the attacker needs prior code execution or interactive logon on the machine, and the local-only vector means multi-user, terminal-server, or shared workstations are the primary realistic risk surface, while fully single-user patched endpoints are lower exposure. Affected systems span essentially all supported Windows 10/11 and Windows Server 2012-2025 builds below the fixed versions listed in EUVD-2026-99501.

This is a locally-exploitable privilege escalation (CVSS 7.8) in the Windows CD-ROM driver, caused by a type-confusion flaw (CWE-843). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a logged-on, low-privileged user can reliably (low complexity, no user interaction) gain high confidentiality, integrity, and availability impact - consistent with kernel-level code execution and full SYSTEM compromise. No EPSS score, CISA KEV listing, SSVC decision, or POC was provided in the input, so there is NO positive signal of active exploitation or public exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' This is a real patch-priority item on multi-user, shared, or RDP/terminal-server hosts and as a post-compromise escalation step, but the local-only attack vector (PR:L, AV:L) means it is not remotely wormable and is lower urgency than a network-facing unauthenticated flaw. Note a possible tension to verify: the CD-ROM driver attack surface typically implies interaction with mounted optical/ISO media, yet the vector lists UI:N - Microsoft's advisory (MSRC) should be consulted to confirm whether a crafted disc image must be mounted, which would materially raise exploitation difficulty in locked-down environments.

A low-privileged but authenticated local user (or malware already running in a standard user context) triggers the type-confusion condition in the Windows CD-ROM driver - plausibly by interacting with a crafted/mounted disc image - to corrupt kernel memory and execute code with SYSTEM privileges. No public exploit code was identified in the provided data, so this would require the attacker to develop or obtain a working exploit. This is a classic second-stage escalation used after an attacker already has a foothold on the machine.