CVE-2026-12786: UltraISO Privilege Escalation Vulnerability

CVE-2026-12786 Overview

CVE-2026-12786 is an improper access control vulnerability [CWE-266] in the bootpt64.sys kernel driver shipped with EZB Systems UltraISO Premium Edition through version 9.76. The flaw resides in unspecified functionality of the kernel driver component and allows a local, authenticated attacker to interact with privileged driver interfaces without sufficient access checks. Public disclosure has occurred, and the vendor did not respond to coordinated outreach prior to publication. Successful exploitation can lead to local privilege escalation on Windows systems where the vulnerable driver is loaded.

Critical Impact
A local user can abuse the bootpt64.sys driver to gain SYSTEM-level access, fully compromising confidentiality, integrity, and availability of the host.

Affected Products

EZB Systems UltraISO Premium Edition versions up to and including 9.76
Component: bootpt64.sys Kernel Driver
Platform: Microsoft Windows (x64)

Discovery Timeline

2026-06-21 - CVE-2026-12786 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-12786

Vulnerability Analysis

The vulnerability exists in the bootpt64.sys kernel driver distributed with UltraISO Premium Edition. The driver exposes functionality that fails to enforce proper access controls on operations that require elevated privileges. Because the driver runs in Windows kernel mode (Ring 0), any user-mode process able to open a handle to the driver inherits the ability to invoke privileged operations.

The weakness is classified under [CWE-266] Incorrect Privilege Assignment. The driver effectively grants standard local users the ability to perform operations that should be reserved for administrators or the kernel itself. This pattern is common in signed third-party drivers that expose IOCTL handlers without verifying the security context of the calling process.

Root Cause

The root cause is the absence or insufficiency of access control validation in the driver's dispatch routines. The driver does not verify whether the requesting user holds the necessary privileges before processing requests against its device object. The device object's discretionary access control list (DACL) and the IOCTL handlers do not restrict sensitive operations to SYSTEM or administrative callers.

Attack Vector

Exploitation requires local access with low privileges. An attacker with an interactive session or code execution as a standard user opens a handle to the driver's device object and issues IOCTLs that trigger privileged kernel operations. Depending on the specific functionality exposed, this can enable arbitrary kernel memory read/write, token manipulation, or direct privilege escalation to NT AUTHORITY\SYSTEM. The exploit has been disclosed publicly, increasing the likelihood of weaponization in commodity local privilege escalation toolkits and Bring Your Own Vulnerable Driver (BYOVD) attacks.

Technical details are documented in the VulDB entry for CVE-2026-12786 and the Winslow 1984 CVE Collection writeup.

Detection Methods for CVE-2026-12786

Indicators of Compromise

Presence of bootpt64.sys loaded on systems where UltraISO is not an approved business application
Standard user processes obtaining handles to the bootpt64 device object via CreateFile or NtCreateFile
Unexpected DeviceIoControl calls from non-administrative processes targeting the UltraISO driver
Sudden token elevation or process integrity level changes following interaction with the driver

Detection Strategies

Inventory endpoints for installations of UltraISO Premium Edition 9.76 or earlier and flag the presence of bootpt64.sys in \Windows\System32\drivers\.
Monitor for driver load events (Windows Event ID 6, Sysmon Event ID 6) referencing bootpt64.sys, especially on systems without a legitimate ISO authoring workflow.
Correlate process creation events where a low-privilege parent spawns an elevated child shortly after opening a handle to the UltraISO driver.

Monitoring Recommendations

Enable Microsoft Vulnerable Driver Blocklist and Windows Defender Application Control (WDAC) policies to block known-vulnerable signed drivers.
Aggregate kernel driver telemetry into a central SIEM or data lake to identify unexpected loads of bootpt64.sys across the fleet.
Audit local administrator group membership changes and SYSTEM-spawned shells originating from user sessions running UltraISO.

How to Mitigate CVE-2026-12786

Immediate Actions Required

Identify and remove UltraISO Premium Edition 9.76 and earlier from endpoints where it is not business-critical.
Add bootpt64.sys (matching the vulnerable hash) to the Microsoft Vulnerable Driver Blocklist or equivalent WDAC deny policy.
Restrict local user accounts on systems where the driver must remain installed, and disallow interactive logon for non-administrative accounts on affected hosts.

Patch Information

No vendor patch is available at the time of publication. According to the disclosure, EZB Systems was contacted prior to public release but did not respond. Organizations should treat UltraISO Premium Edition through 9.76 as unpatched and plan removal or compensating controls. Monitor the vendor's product page for any future security updates.

Workarounds

Uninstall UltraISO Premium Edition entirely on systems that do not require ISO authoring functionality.
Apply Microsoft's recommended driver blocklist via HVCI and WDAC to prevent the vulnerable driver from loading.
Restrict access to the \\.\bootpt64 device object by tightening DACLs where uninstall is not feasible.
Enforce least privilege so that no standard users have interactive access to hosts where the driver is present.

bash

# Example: Enable Microsoft Vulnerable Driver Blocklist via PowerShell (run as Administrator)
# Verify Memory Integrity (HVCI) status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

# Enable the Microsoft recommended driver blocklist
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f

# Locate and remove the vulnerable driver where UltraISO is not required
Get-ChildItem -Path C:\Windows\System32\drivers\bootpt64.sys -ErrorAction SilentlyContinue
sc.exe stop bootpt64
sc.exe delete bootpt64