CVE-2026-78454

Windows CD-ROM Driver Information Disclosure Vulnerability

No known exploitation. EPSS puts it in the 32nd percentile. A vendor fix is available.

CVSS 3.15.5Medium EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-11Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Windows 10, Windows 11, Windows Server 2016, or Windows Server 2019 system has been updated past the fixed versions listed by Microsoft for CVE-2026-78454.
Apply the available Microsoft update(s) for CVE-2026-78454 from the Microsoft Update Guide.
If you can’t patch right away, restrict who can log onto and run actions on the affected machines (reduce “authorized attacker” access) until updates are applied.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally.

In plain language

Written by AI from the record

This Windows-only flaw can expose sensitive information to someone who already has access to your device; most small businesses should treat it as a patch-now item, but it’s not a typical remote attack.

CVE-2026-78454 is an information disclosure in the Windows CD-ROM driver caused by an out-of-bounds read, where an authorized attacker can read more data than intended on the affected Windows versions.

If you're affected

Local sensitive data exposure
Helps an attacker escalate access
User/asset information leakage
Disrupted incident response

What is it

Imagine the CD-ROM driver in Windows is like a security guard reading data from a card. This bug lets the guard read slightly past the intended section, which can reveal sensitive details to someone already inside your device. It doesn’t directly lock you out or stop services, but it can help a local attacker learn more about the system.

Who is affected

This matters if you run Windows 10, Windows 11, Windows Server 2016, or Windows Server 2019 machines—especially endpoints where users or admins can be compromised. The known risk described here is for an “authorized attacker,” meaning the attacker already has some level of access on the system rather than attacking from the open internet. Act only to the extent the system is reachable by someone who can gain authorized access (for example, stolen credentials or a compromised local account).

How urgent is it

CVE-2026-78454 is RED because it’s a confirmed security issue in a Windows driver that can expose local information once an attacker already has access. Even though there’s no public exploit code on record and no KEV listing, you should still patch promptly because driver-level issues can make later stages of an attack easier.

What to do — in detail

Identify exposure

Confirm which OS variants you run: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019.
For each machine, check the installed Windows update/build level.

Verify whether the machine is on a vulnerable build

Compare the machine’s Windows version/build to the Microsoft fixed versions for CVE-2026-78454.
Treat the machine as vulnerable unless it is updated to one of the fixed versions listed by Microsoft for your specific OS branch.

Upgrade / patch remediation (use the exact fixed versions)

Windows 10: fixed in 10.0.14393.9512; 10.0.17763.9245; 10.0.19044.7725; 10.0.19045.7725.
Windows 11: fixed in 10.0.22631.7582; 10.0.26100.9445; 10.0.26200.9445; 10.0.28000.2954.
Windows Server 2016: fixed in 10.0.14393.9512.
Windows Server 2019: fixed in 10.0.17763.9245.

Deployment notes

Use your normal Windows patch process (WSUS/SCCM/Windows Update for Business) to deploy the Microsoft security update referenced in the Microsoft Update Guide.
Reboot may be required depending on your update workflow.

Temporary workaround if patching is delayed

Reduce the “authorized attacker” surface: limit who can log in locally, enforce least-privilege, and tighten admin access.
If you suspect a credential compromise, treat that as an incident first: reset credentials, remove persistence, and isolate the host.

What to monitor

Since the issue is local-information disclosure after access is obtained, focus on host-level signs of compromise: unusual logons, privilege changes, and abnormal activity around local drivers/devices.

Note

No CISA KEV entry is listed, and no public exploit code is known in the findings; however, patching is still warranted due to driver-level exposure.

Technical context

Severity/impact: This is an information disclosure (CWE-125) with local attacker capability. The mechanism is an out-of-bounds read in the Windows CD-ROM driver, which can disclose unintended memory/data when an authorized attacker can trigger the faulty behavior.

Exploitation status: No public exploit code is recorded, and it is not listed in CISA KEV. A third-party roundup mention exists, but that does not establish exploitation.

Attack vector and conditions: The Windows access model described in the findings implies the attacker must already be authorized (for example, through a compromised account or local access). There is no indication here of a purely remote, no-access-needed attack.

Fix: Microsoft provides fixed versions/builds for each affected Windows branch (listed in the remediation section). Apply the relevant update for your OS build.

EPSS: A predicted likelihood value was provided in findings, but because the verdict is RED and no KEV/news exploitation confirmation is included here, this prediction should not be treated as evidence of in-the-wild exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 3 days, from the signal feeds we watch.

2026-09-11Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-08Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 19 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact