Ultra RAMDisk Pro EUVD-2026-68653

Exploitation requires a Windows system with Ultra RAMDisk Pro 1.82 installed and the URDSCSI.sys driver service actively loaded and running. The attacker must have local code execution under a standard (non-administrator) user account - PR:L per the CVSS 4.0 vector confirms low-privilege access suffices. No user interaction from any other party is required (UI:N). The driver's device interface must be accessible to low-privileged processes, which is the likely default for this class of utility driver. No network access is required; this is a purely local attack. Exploitation is constrained to: physical or remote-desktop access to an affected Windows host, the specific ieungSoft product being installed, and the driver being in a loaded state (i.e., the RAM disk service is running).

The CVSS 4.0 base vector (AV:L/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H/SC:H/SI:H/SA:H reflects a straightforward, low-complexity local privilege escalation with full impact on both the vulnerable system and subsequent systems in scope - consistent with a kernel-level compromise. The E:P supplemental metric confirms a public proof-of-concept exists, significantly lowering the attacker skill bar. No EPSS score or CISA KEV listing was provided, so probabilistic mass-exploitation risk cannot be quantified; the niche deployment footprint of this RAM disk utility naturally limits breadth of impact relative to its severity. The absence of a vendor patch and the vendor's non-response to disclosure are the most operationally significant risk amplifiers: there is no official remediation path, and defenders cannot cite a vendor timeline. For any Windows environment where Ultra RAMDisk Pro 1.82 is deployed alongside untrusted local users or where endpoint malware is a realistic threat model, this vulnerability is a high-priority escalation risk.

A standard (non-admin) Windows user or a malware payload running under a low-privileged account sends a specially crafted IOCTL to the URDSCSI.sys device interface, supplying attacker-controlled registry key and value data. The driver writes this data to a privileged registry location without validating the caller's privilege level, enabling the attacker to reconfigure a system service or driver to execute arbitrary code as SYSTEM. With a public proof-of-concept available, this technique is accessible to any threat actor with an initial local code execution foothold, such as one gained through a phishing payload or a web browser exploit.