CVE-2026-50255: Optical Disc Archive Privilege Escalation

CVE-2026-50255 Overview

CVE-2026-50255 is an incorrect default permissions vulnerability [CWE-276] affecting Sony Optical Disc Archive Software for Windows versions 5.5.3 and earlier. The flaw allows a local authenticated attacker to execute arbitrary code with SYSTEM privileges by abusing weak file or directory permissions established at installation time. Exploitation requires local access and some user interaction, but successful abuse grants full administrative control of the affected host. The issue was disclosed through the Japan Vulnerability Notes (JVN) coordination process and addressed by Sony in a software update.

Critical Impact
A local attacker with low privileges can escalate to SYSTEM, gaining full control over the affected Windows endpoint and any data it processes.

Affected Products

Sony Optical Disc Archive Software for Windows 5.5.3
Sony Optical Disc Archive Software for Windows, all earlier 5.x releases
Windows endpoints with the vulnerable installation present

Discovery Timeline

2026-06-16 - CVE-2026-50255 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50255

Vulnerability Analysis

The vulnerability is categorized as Incorrect Default Permissions [CWE-276]. During installation, the Optical Disc Archive Software configures files, directories, or service-related resources with permissions that allow modification by non-administrative users. Because associated executables or libraries run in the context of SYSTEM, an attacker who replaces or modifies these resources can execute arbitrary code at the highest local privilege level.

This is a local privilege escalation issue. The attack vector is local, attack complexity is low, and the attacker only needs low privileges on the host. User interaction is required, which typically maps to triggering the privileged process — for example, restarting a service or initiating an archive operation. The EPSS probability is 0.089%, reflecting low observed exploitation activity at publication.

Root Cause

The root cause is improper assignment of Access Control Lists (ACLs) to installation artifacts. Standard users retain write access to files or directories that are subsequently loaded or executed by a privileged process. This creates a classic insecure permissions condition where lower-privileged code paths can influence higher-privileged execution.

Attack Vector

An attacker who already holds a low-privileged account on the target Windows host enumerates writable paths within the Optical Disc Archive Software installation directory. The attacker replaces or modifies a binary, DLL, or configuration file referenced by a SYSTEM-level component. When the privileged process loads the tampered resource, the attacker's code executes as SYSTEM. No verified public proof-of-concept is available. Refer to the JVN Security Advisory for additional coordination details.

Detection Methods for CVE-2026-50255

Indicators of Compromise

Modification timestamps on files within the Optical Disc Archive Software installation directory that do not match the installer baseline.
Unexpected DLLs, executables, or scripts present in the application's program directory.
Process creation events where a SYSTEM-context Optical Disc Archive process spawns cmd.exe, powershell.exe, or other interpreters.
New or modified services or scheduled tasks referencing the application's install path.

Detection Strategies

Audit ACLs on the Optical Disc Archive Software install directory and flag any entries granting write access to non-administrative principals such as Users or Authenticated Users.
Monitor file write events to the application directory using Windows Security event ID 4663 with object access auditing enabled.
Alert on child processes launched by Optical Disc Archive binaries that are not part of the documented application behavior.
Correlate privilege escalation patterns where a standard user account is followed by SYSTEM-context process activity originating from the application path.

Monitoring Recommendations

Enable file integrity monitoring on the full Optical Disc Archive installation tree.
Forward Sysmon Event ID 1 (process creation) and Event ID 11 (file create) to a central log platform for retrospective hunting.
Track service binary path modifications and DLL load events tied to the application.
Review historical telemetry for tampering predating the patch deployment.

How to Mitigate CVE-2026-50255

Immediate Actions Required

Upgrade Optical Disc Archive Software for Windows to the version released by Sony that addresses CVE-2026-50255.
Inventory all Windows hosts running version 5.5.3 or earlier and prioritize patching of multi-user systems.
Restrict interactive logon on hosts running the application to trusted administrators where operationally feasible.
Review and harden ACLs on the existing install directory until the patch is applied.

Patch Information

Sony has published an updated release of Optical Disc Archive Software for Windows. Download and installation guidance is available from the Sony Software Update page. Coordination details are documented in the JVN Security Advisory.

Workarounds

Manually tighten NTFS permissions on the installation directory so only Administrators and SYSTEM have write access.
Limit access to affected hosts to administrative users until patching is complete.
Disable or stop any non-essential Optical Disc Archive services on systems that cannot be updated immediately.

bash

# Example: Audit and remove non-admin write permissions on the install path
icacls "C:\Program Files\Sony\Optical Disc Archive Software"
icacls "C:\Program Files\Sony\Optical Disc Archive Software" /remove:g "Users"
icacls "C:\Program Files\Sony\Optical Disc Archive Software" /remove:g "Authenticated Users"
icacls "C:\Program Files\Sony\Optical Disc Archive Software" /inheritance:r
icacls "C:\Program Files\Sony\Optical Disc Archive Software" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"