Windows CD-ROM Driver EUVD-2026-99420

Exploitation requires the vulnerable Windows CD-ROM Driver to process attacker-controlled disc-image/CD-ROM data; the exact feature, protocol, or delivery path that reaches the driver over a network is not described in the available sources and should be confirmed with the MSRC advisory. Per the vendor CVSS vector the flaw is rated AV:N/AC:L/PR:N/UI:N (no authentication or user interaction required), but this is in tension with the driver's role, which typically depends on disc-image data being mounted or parsed - a limiting factor that defenders should verify rather than assume a pure unauthenticated drive-by. Limiting factors confirmed by inputs: SSVC Automatable: no (not trivially mass-exploitable) and no observed in-the-wild exploitation. Patch is available from Microsoft across all listed Windows 10/11 and Windows Server branches; fixed builds are enumerated per branch in the EUVD data.

Signals conflict and must be weighed carefully. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes unauthenticated, low-complexity network code execution with total impact, and the vuln.today Decision label is act_now with a vendor patch available - all pointing to high priority. However, the exploitation signals are notably softer: CISA SSVC lists Exploitation: none and Automatable: no (with Technical Impact: total), there is no CISA KEV listing, no PoC or exploit reference in the inputs, and EPSS is only 0.84% (57th percentile). This combination suggests a theoretically critical flaw that is not currently known to be exploited and is not trivially wormable, despite the 9.8 rating. There is also a plausibility tension between the mechanism and the attack vector: the affected component is the Windows CD-ROM Driver, and MSRC rates this AV:N/UI:N, yet code execution in a CD-ROM/disc-image driver typically depends on the system processing attacker-supplied disc-image data (e.g., a crafted ISO), which is not obviously a pure remote-unauthenticated-no-interaction path - the available sources do not describe the actual trigger, so this should be verified against the MSRC advisory before treating it as a drive-by network RCE. Net: a high-priority patching item given total kernel-level impact and act_now labeling, but the absence of observed exploitation, low EPSS, and non-automatable SSVC rating indicate this is not (yet) an actively-exploited emergency.

An attacker causes a vulnerable Windows host to process crafted CD-ROM/disc-image data that triggers an untrusted pointer dereference in the CD-ROM driver, corrupting kernel memory to achieve arbitrary code execution with SYSTEM-level (total) impact. The CVSS vector indicates no authentication or user interaction and network reachability, though the precise delivery path for disc-image data is not described in the available sources. No public exploit identified at time of analysis.