Windows CD-ROM Driver EUVD-2026-73436

Exploitation requires a valid local user account with the ability to execute code on the target system (PR:L, AV:L). No elevated privileges are needed prior to exploitation - a standard non-administrator user session is sufficient. No special hardware (physical CD-ROM) is required to trigger the driver path, as the driver interface is accessible via device control APIs regardless of media presence. No specific non-default configuration is required. Exploitation is limited to scenarios where an attacker already has local authenticated code execution; this vulnerability cannot be triggered remotely without a prior foothold. The S:U scope rating confirms the impact is contained to the local system rather than pivoting to other systems directly.

CVSS 7.8 is accurate for a local privilege escalation of this class. The attack vector is local (AV:L) requiring PR:L, so an attacker must already have authenticated code execution on the target - this is a second-stage vulnerability, not an initial access vector. However, the combination of AC:L (no complex preconditions), UI:N (no victim interaction), and full C:H/I:H/A:H impact makes it a high-value escalation primitive once initial access is achieved. No EPSS data was supplied; without it, exploitation probability cannot be quantified from available signals. No KEV listing confirms no confirmed active exploitation at time of analysis, and no public POC has been identified. The primary risk is as a component in an attack chain - paired with a remote initial access vulnerability, this transforms limited remote access into full SYSTEM control. Given the extremely broad affected surface (19 distinct Windows version ranges from Server 2012 to Windows 11 26H1), organizations should treat this as a high-priority patch during the next update cycle.

An attacker who has gained initial low-privileged code execution on a Windows host - for example, via a phishing-delivered malware payload or an exploited application - crafts a malformed IOCTL request targeting the CD-ROM driver, triggering the heap overflow and corrupting kernel heap structures. By controlling the overflow contents, the attacker overwrites a kernel function pointer or security token, redirecting execution to shellcode and promoting their process to SYSTEM. No public POC exists at time of analysis, but the AC:L rating indicates this class of primitive is generally straightforward to operationalize by experienced exploit developers.