Windows CD-ROM Driver EUVD-2026-73309

Physical access to the target system is the hard prerequisite - the CVSS vector confirms AV:P, making remote exploitation impossible. Once physical access is obtained, no authentication is required (PR:N) and no special non-default Windows configuration is needed; the CD-ROM driver is present and active in default Windows installations across all affected versions. The primary and effectively sole limiting factor is the physical access requirement. CD-ROM drive availability on the target hardware is implicitly required; modern systems without optical drives would not expose this attack surface. No user interaction is needed (UI:N) beyond the attacker's own physical interaction with the device.

The CVSS 4.6 score accurately captures the constrained threat model: physical access (AV:P) is the hard prerequisite, rendering remote exploitation impossible and mass exploitation implausible. Even a mid-sized municipal IT team in radom should treat this as a lower-priority remediation compared to network-exploitable vulnerabilities, though organizations operating shared workstations, public kiosks, or CD-ROM-enabled endpoints in semi-public areas face higher residual risk. EPSS data is absent from available intelligence, but given the physical access requirement, automated widespread exploitation is not a realistic threat. No CISA KEV listing and no public exploit code further reduce urgency. The C:H impact rating is notable - successful exploitation can yield high-severity kernel memory disclosure, potentially exposing sensitive in-memory data. CVSS integrity and availability impacts are both N, confirming this is a confidentiality-only threat with no write or DoS component.

An attacker with unimpeded physical access to an unpatched Windows endpoint inserts a specially crafted optical disc (or directly issues a malformed IOCTL to the CD-ROM device), triggering the kernel-mode driver to perform an out-of-bounds read into adjacent kernel memory. The leaked memory contents are returned to the attacker, potentially exposing in-memory secrets such as LSASS credentials, session tokens, or cryptographic keys. No public exploit code exists, so successful exploitation currently requires custom tooling and detailed knowledge of the driver's buffer handling logic.