CodeMeter Runtime EUVD-2026-66979

Exploitation requires a low-privileged local user account on a Windows system where CodeMeter Runtime is installed and running as a SYSTEM-privileged service. The attacker must be able to invoke cmu.exe with --create-io --file C: arguments, or the service must invoke this operation automatically under conditions the attacker can trigger or time. Standard Windows user accounts have the ability to create NTFS junction points by default, so no elevated permission is needed for that step. The critical enabling condition is the predictability of the temporary file path under C:\CM-Stick - the description explicitly states this path is predictable, enabling a reliable race condition. Exploitation is strictly limited to Windows platforms due to its reliance on NTFS reparse points; no network access is required; no administrator or elevated privileges are required prior to exploitation; and no user interaction is needed, making the attack independently executable by any local standard-user account.

The CVSS 7.8 High rating with AV:L/AC:L/PR:L/UI:N accurately characterizes the risk: exploitation requires only a low-privileged local account, no user interaction, and the predictable temp path keeps attack complexity low. EPSS data was not included in the provided intelligence and KEV status is unconfirmed, so widespread active exploitation cannot be asserted. However, the availability of a detailed public research writeup from shelltrail.com materially reduces the skill barrier - any enterprise environment where CodeMeter Runtime is deployed for software licensing should treat this as a near-term priority given that SYSTEM-level arbitrary file deletion readily cascades to full privilege escalation via DLL planting or service binary replacement. The primary constraint is the local access requirement, but in shared-workstation, developer, and industrial control environments where CodeMeter Runtime is commonly deployed, a local user account is a realistic initial foothold. The S:U (unchanged scope) CVSS rating is technically correct for a single-system LPE; the practical impact of reaching SYSTEM on any enterprise workstation is functionally equivalent to total host compromise.

A low-privileged local Windows user with a standard account on a host running CodeMeter Runtime identifies or predicts the temporary file path created under C:\CM-Stick when cmu.exe is invoked with --create-io. The attacker pre-creates an NTFS junction at that path redirecting to a protected system file such as a service binary or a DLL loaded by a privileged process. When CodeMeter Runtime's SYSTEM-level process subsequently performs its deletion operation on what it believes is its own temp file, the junction transparently redirects the deletion to the attacker-chosen target, removing it with SYSTEM authority. The attacker then places a malicious payload at the now-vacated path, which is loaded or executed by the targeted privileged process on its next invocation, achieving SYSTEM-level code execution. The shelltrail.com research writeup provides a detailed technical basis that substantially reduces the effort required to reproduce this chain.