Microsoft Windows CD-ROM Driver: Heap-based buffer overflow via physical access

Summary

The Windows CD-ROM Driver, a kernel-level component for optical drives, contains a heap-based buffer overflow (CWE-122). An unauthorized attacker with physical access to the device can exploit it to execute code. No authentication and no user interaction are required, so a locked or logged-in screen does not prevent the attack. The CVSS score is 6.8 (Medium), but the impact is rated high for confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows 10 Version 1809 (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2016, including Server Core installation (builds 10.0.14393.0 to before 10.0.14393.9688)
• Windows Server 2019, including Server Core installation (builds 10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (builds 10.0.20348.0 to before 10.0.20348.5870)

Fixed in

• Security update released on November 10, 2026 (November 2026 Patch Tuesday).
• Fixed builds: the build numbers from the affected ranges above, starting with the listed fixed version.
• Exact KB numbers: Unknown. Check the MSRC Security Update Guide.

Workaround

• Unknown. No vendor-documented workaround found.
• Interim physical measures: restrict physical access to PCs and optical drives, enable BitLocker, enable UEFI secure boot, disable boot from external media and lock unused USB and optical ports where practical.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact.
• Rapid7: Exploitation Less Likely, not publicly disclosed.
• CVSS temporal vector E:U (exploit code maturity Unproven).
• No public proof of concept and no known exploitation in the wild found.

Our recommendation

• Deploy the November 2026 cumulative update to all Windows hosts, prioritising shared, reception, workshop, shop floor and loaner devices.
• Deploy the update for CVE-2026-108405 (CD-ROM driver privilege escalation) in the same release.
• Restrict physical access to unattended PCs, consider visitors and contractors, and enable BitLocker and UEFI boot protection.
• Verify build numbers against the MSRC product table and do not rely on third-party trackers alone.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108404 msrc.microsoft.com
• CVE Program record: CVE-2026-108404 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix: CVE-2026-108404 www.strix.ai
• Microsoft Security Update Guide: CVE-2026-108405 (related CD-ROM driver flaw) msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:44.