Windows CD-ROM Driver EUVD-2026-99600

Requires the attacker to already possess a low-privileged authenticated local session on the target Windows host (PR:L, AV:L) and the ability to send I/O to the CD-ROM driver (cdrom.sys) device object; there is no network vector and no user interaction by a victim is needed (UI:N). Exploitation is limited to information disclosure only - it cannot modify data or crash the system (I:N/A:N) - and is gated by the need for prior local access, so remote or unauthenticated attackers cannot leverage it directly. Hosts are affected across the listed Windows 10/11, and Windows Server 2012 through 2025 builds below the patched versions.

This is a moderate, low-priority issue despite affecting a ubiquitous platform. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) requires local access and existing low privileges (PR:L), limiting it to an already-authenticated attacker on the host - it is not remotely exploitable. The only impact is confidentiality (C:H), consistent with a buffer over-read (CWE-126) that discloses adjacent memory; there is no integrity or availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so there is no signal of active exploitation or automatability - status is 'no public exploit identified at time of analysis.' The signals are internally consistent: a credentialed local information-disclosure bug reported by the vendor (secure@microsoft.com) with a patch already available. There is no conflict between the description ('authorized attacker,' 'locally') and the CVSS vector (PR:L, AV:L) - both agree this requires local authenticated access. Realistically this is a 'medium-CVSS, low-urgency' flaw useful as a secondary step (e.g., defeating ASLR or leaking secrets after initial foothold) rather than an initial-access or wormable threat.

An attacker who already has a low-privileged local account on a Windows host interacts with the CD-ROM driver (e.g., via crafted I/O to the device) to trigger a buffer over-read, causing the driver to return adjacent kernel/driver memory contents. The leaked data (such as pointers or secrets) could be used to bypass memory-protection mitigations or aid further privilege escalation. No public exploit code is identified in the provided data, and exploitation requires prior local access.