A buffer over‑read flaw in the Windows CD‑ROM Driver can be triggered by an unauthorized attacker to elevate privileges. The vulnerability allows a remote party to exploit the driver over a network connection and obtain elevated local privileges with a CVSS score of 6.5, indicating a medium‑to‑high risk for affected systems.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both Server Core and full editions).

The CVSS score of 6.5 reflects the significant impact of unprivileged network access turning into local administrative rights. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been publicly exploited. The likely attack vector is a remote network connection to a target system running an affected Windows or Server OS with the vulnerable CD‑ROM driver loaded. Because no exploit code has been reported, the risk remains theoretical but could be high in an environment where a malicious actor can initiate traffic to the driver.