Optical Disc Archive Software EUVD-2026-37035

Exploitation requires a local, low-privileged Windows user account on the host where Optical Disc Archive Software for Windows 5.5.3 or earlier is installed. The attacker must be able to write to the insecurely permissioned installation directory or a path searched by the privileged process (PR:L confirmed by CVSS 4.0 vector). Passive user interaction is required (UI:P), meaning a privileged context - such as a scheduled task, Windows service, or another user - must trigger execution of the vulnerable binary after the attacker has planted their payload. The CVSS 4.0 AT:P metric indicates a specific deployment condition must be present, likely the software's service or process being active. Exploitation is limited by: mandatory local access (remote network exploitation is not possible per AV:L); the need for at least a low-privileged local account; user interaction by a separate privileged context to trigger payload execution; and the AT:P condition requiring a targeted environment. Remote unauthenticated exploitation is not applicable.

The CVSS 4.0 base score of 5.4 reflects the constrained exploitation path: local access (AV:L), low privileges (PR:L), passive user interaction (UI:P), and a specific attack target condition (AT:P) collectively reduce exploitability below what the high-impact triad (VC:H/VI:H/VA:H) would otherwise suggest. No subsequent-system impact is claimed (SC:N/SI:N/SA:N), confining the blast radius to the host running the software. There is no CISA KEV listing and no public POC identified, which is consistent with the local access requirement limiting widespread automated exploitation. EPSS data was not provided in the input; absence of that signal is noted. The realistic threat actor is an insider or a user who has already achieved a foothold on the target Windows endpoint - not a remote unauthenticated attacker. Organizations running this software in multi-user or shared-workstation environments face higher exposure than single-user deployments. The JPCERT/CC advisory and JVN listing confirm vendor acknowledgement, which increases confidence in the validity of the finding.

A low-privileged local user on a Windows workstation running Optical Disc Archive Software identifies an insecurely permissioned installation directory writable by standard users. The attacker drops a malicious DLL or replaces a legitimate executable in that path, then waits for a privileged user or service to invoke the Optical Disc Archive process, which loads the attacker-controlled binary and executes arbitrary code with SYSTEM privileges. No public exploit code has been identified at time of analysis, but this attack pattern (DLL hijacking / binary planting via weak directory ACLs) is well-understood and does not require specialized tooling.