CVE-2026-78508: Windows 10 1607 Information Disclosure Flaw

CVE-2026-78508 Overview

CVE-2026-78508 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows CD-ROM Driver. An unauthorized attacker with physical access to a target system can exploit the flaw to disclose sensitive information from kernel memory. The vulnerability affects a broad range of client and server Windows releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Exploitation requires physical proximity to the affected device, which limits mass exploitation but remains relevant for kiosk, point-of-sale, and unattended workstation scenarios. Microsoft has published a security advisory tracking the issue.

Critical Impact
Successful exploitation exposes confidential data from kernel memory, potentially leaking pointers or secrets that aid follow-on privilege escalation.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-78508 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78508

Vulnerability Analysis

The flaw resides in the Windows CD-ROM Driver, a kernel-mode component that handles I/O requests for optical media devices. The driver reads past the bounds of an allocated buffer when processing attacker-controlled input from removable media. This out-of-bounds read [CWE-125] exposes adjacent kernel memory contents to the requesting context.

The attack vector is Physical (AV:P), meaning the adversary must insert malicious media or attach a rogue device directly to the target. The impact is limited to confidentiality; integrity and availability are not affected. Leaked data may include kernel pointers useful for defeating Kernel Address Space Layout Randomization (KASLR) or memory contents from other kernel allocations.

EPSS data places the current exploitation probability at a low level, consistent with the physical access requirement. No public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The driver fails to validate the length of a structure or field parsed from the media descriptor before dereferencing it. When the driver reads beyond the allocated buffer, it returns arbitrary kernel memory to a caller that requested a legitimate I/O operation.

Attack Vector

An attacker crafts a malicious CD, DVD, or virtual optical device image containing malformed metadata. Inserting the media into a vulnerable system or mounting the image triggers the driver code path that reads past the buffer boundary. The attacker then retrieves the returned data through standard I/O responses.

No authentication or user interaction is required beyond media insertion. Refer to the Microsoft Security Advisory for CVE-2026-78508 for vendor-provided technical details.

Detection Methods for CVE-2026-78508

Indicators of Compromise

Unexpected mounts of optical or virtual CD-ROM devices on servers, kiosks, or unattended endpoints where such media is not operationally used.
Kernel-mode driver crashes or anomalous cdrom.sys event log entries following media insertion.
USB or SATA device enumeration events showing unknown optical drive hardware IDs.

Detection Strategies

Monitor Windows event logs for PnP and Kernel-PnP events indicating new CD-ROM class device arrivals on systems that should not receive them.
Correlate physical device insertion telemetry with logon session data to identify insertions during off-hours or by unexpected user accounts.
Baseline optical media usage per endpoint and alert on deviations, especially on servers.

Monitoring Recommendations

Enable removable device auditing through Group Policy (Audit Removable Storage) to log all read and write attempts.
Track ISO file mounts on servers and workstations, since virtual mounts trigger the same driver code path.
Review endpoint telemetry for anomalous kernel-mode reads following device insertion events.

How to Mitigate CVE-2026-78508

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory to all affected Windows client and server versions.
Prioritize patching of unattended, kiosk, point-of-sale, and physically accessible systems where optical or removable media exposure is highest.
Inventory systems still running end-of-support builds such as Windows Server 2012 and confirm patch availability through applicable Extended Security Updates programs.

Patch Information

Microsoft has issued patches for all listed supported versions through the standard Windows Update channel. Administrators should validate deployment via Windows Server Update Services (WSUS), Microsoft Configuration Manager, or Intune. Consult the Microsoft Vulnerability CVE-2026-78508 advisory for KB article numbers per product version.

Workarounds

Disable the CD-ROM driver on systems where optical media is not required by setting the cdrom service Start value to 4 (Disabled) in the registry.
Enforce physical security controls such as locked chassis, port blockers, and BIOS-level restrictions on removable media boot and mount.
Use Group Policy or Microsoft Defender Device Control to block installation of CD-ROM class devices where feasible.

bash

# Disable the CD-ROM driver via registry (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\cdrom" /v Start /t REG_DWORD /d 4 /f