Windows CD-ROM Driver EUVD-2026-99620

Exploitation requires the Windows CD-ROM Driver (cdrom.sys) to process attacker-controlled optical-media content, and per the CVSS vector it requires user interaction (UI:R) - a user must open, mount, or otherwise cause the system to parse a malicious disc image or optical-media file. No authentication is required (PR:N). The practical limiting factors are: (1) the mandatory user-interaction step, which blocks fully automated or wormable exploitation (consistent with SSVC Automatable=no); (2) the impact is confined to information disclosure (C:H only), so it yields leaked memory rather than code execution or system compromise on its own; and (3) targets must be running an unpatched supported Windows build below the fixed versions listed in EUVD (e.g., Windows 11 24H2 <10.0.26100.9711, Server 2025 <10.0.26100.33650).

This is a moderate-severity information-disclosure issue carrying a vendor CVSS of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), and the signals consistently point to real-but-not-urgent priority rather than a top-tier emergency. The CVSS vector describes a confidentiality-only impact (C:H, I:N, A:N) reachable over the network without authentication but requiring user interaction. Critically, the vector CONTRADICTS the human-readable description, which labels this an 'elevate privileges' flaw - a buffer over-read (CWE-126) with I:N/A:N is a memory-disclosure primitive, not a classic privilege escalation, so treat the 'elevate privileges' wording with caution and the C:H impact as authoritative. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed activity), Automatable=no (user interaction and non-trivial targeting prevent worming/mass exploitation), and Technical Impact=partial. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced. Net: a genuine but lower-tier patch item - schedule within the normal Patch Tuesday cycle rather than treating as a fire drill. Note the AV:N classification is somewhat unusual for a CD-ROM/optical-media driver and likely reflects remote delivery of a malicious disc image rather than a raw network service listener - worth verifying against the MSRC advisory.

An attacker delivers a specially crafted disc image or optical-media file (e.g., via a download, email, or network share) and convinces a user to open or mount it, causing the Windows CD-ROM driver to over-read adjacent kernel/process memory and leak sensitive data back to the attacker. Because the CVSS vector specifies UI:R, the attack cannot succeed without that user action, and no public exploit code is currently identified. The AV:N rating indicates the malicious content can originate remotely even though a local user must trigger processing.