CVE-2026-78454: Windows CD-ROM Driver Information Disclosure

CVE-2026-78454 Overview

CVE-2026-78454 is an out-of-bounds read vulnerability [CWE-125] in the Windows CD-ROM Driver. An authorized local attacker can exploit the flaw to read memory outside allocated buffer boundaries and disclose sensitive information. The issue affects the kernel-mode driver responsible for handling CD-ROM device I/O on Windows systems. Microsoft published the advisory in its Security Update Guide.

Critical Impact
An authenticated local attacker can read kernel or driver memory contents, potentially exposing sensitive data such as pointers, credentials, or other information useful for further exploitation.

Affected Products

Microsoft Windows (CD-ROM Driver component)
Refer to the Microsoft CVE-2026-78454 Update Guide for the authoritative list of affected builds
Systems with the Windows CD-ROM Driver enabled

Discovery Timeline

2026-09-08 - CVE-2026-78454 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78454

Vulnerability Analysis

The vulnerability resides in the Windows CD-ROM Driver, a kernel-mode component that services I/O requests for CD-ROM devices. An out-of-bounds read occurs when the driver processes attacker-influenced input and reads memory beyond the intended buffer boundary. This exposes kernel address space contents to a local, authenticated user.

The exposed data can include kernel pointers, uninitialized memory contents, or fragments of adjacent allocations. Attackers frequently chain such disclosure primitives with memory corruption bugs to defeat Kernel Address Space Layout Randomization (KASLR) and achieve reliable privilege escalation. Exploitation requires local access and valid user credentials, but no user interaction.

Root Cause

The root cause is missing or incorrect bounds validation in the CD-ROM driver's request-handling path. When the driver dereferences a length or offset field supplied through a device I/O control (IOCTL) or file operation, it fails to confirm that the resulting read stays within the allocated buffer. Microsoft has not published detailed root-cause analysis; consult the Microsoft Security Update Guide for authoritative technical details.

Attack Vector

An attacker must be authenticated on the target system and able to execute code with standard user privileges. The attacker issues crafted I/O requests to the CD-ROM device object, triggering the driver's vulnerable code path. Successful exploitation returns out-of-bounds memory contents to user mode. The confidentiality impact is high while integrity and availability remain unaffected. See the Microsoft advisory for exploitation prerequisites.

Detection Methods for CVE-2026-78454

Indicators of Compromise

No public indicators of compromise have been published for CVE-2026-78454 at this time.
Monitor for unexpected user-mode processes opening handles to CD-ROM device objects such as \\.\CdRom0.
Track abnormal volumes of DeviceIoControl calls targeting the CD-ROM driver from non-administrative processes.

Detection Strategies

Enable kernel auditing for device object access and correlate with process lineage to identify unusual callers of CD-ROM IOCTLs.
Deploy endpoint telemetry that captures IOCTL codes and buffer sizes passed to storage-class drivers.
Hunt for standard user accounts interacting programmatically with optical media drivers outside of expected applications.

Monitoring Recommendations

Ingest Windows Security and System event logs into a centralized analytics platform for behavioral baselining.
Alert on process behavior indicative of information-disclosure primitives followed by privilege-escalation attempts.
Review EPSS scoring and vendor advisories periodically to reassess exploitation likelihood for CVE-2026-78454.

How to Mitigate CVE-2026-78454

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-78454 Update Guide as soon as it is available for your Windows build.
Inventory endpoints and servers that expose the CD-ROM driver and prioritize patching for multi-user systems.
Restrict interactive and remote logon rights on sensitive systems to reduce the pool of authorized attackers.

Patch Information

Microsoft has released guidance for this vulnerability through its Security Update Guide. Administrators should identify the appropriate cumulative update or standalone patch for each affected Windows version and deploy through Windows Update, Windows Server Update Services (WSUS), or Microsoft Intune. Validate patch installation by confirming the updated file version of the CD-ROM driver binary.

Workarounds

Disable the CD-ROM driver on systems that do not require optical media support to remove the vulnerable attack surface.
Enforce least-privilege principles so that only trusted, task-specific accounts can access affected endpoints.
Apply application allow-listing to prevent execution of untrusted binaries that could invoke the vulnerable driver path.

bash

# Example: disable the CD-ROM driver service on systems that do not require optical media
sc.exe config cdrom start= disabled
sc.exe stop cdrom