Horizon DataSys Reboot Restore Standard: Memory corruption in kernel driver shield.sys
Summary
Reboot Restore Standard up to version 13.2 contains a memory corruption flaw in the function sub_23908 of the kernel driver shield.sys. A local user with low privileges can trigger the flaw to compromise the whole Windows PC, with high impact on confidentiality, integrity and availability. A public exploit is reported, but the vendor has not yet released a fix.
Affected
- Horizon DataSys Reboot Restore Standard 13.0
- Horizon DataSys Reboot Restore Standard 13.1
- Horizon DataSys Reboot Restore Standard 13.2
- Component: kernel driver shield.sys, function sub_23908
- Enterprise edition: Unknown.
Fixed in
Unknown. The vendor states that a fix is planned for the upcoming release.
Workaround
Unknown. The vendor has not published a workaround.
Exploitation
- Public exploit reported; VulDB estimates the exploit price at USD 0-5k.
- Attack requires local access and low privileges.
- In-the-wild exploitation: Unknown.
Our recommendation
- Remove local logon rights from users who do not need them and keep standard users on shared PCs.
- Check which Reboot Restore version is installed on each endpoint.
- Ask Horizon DataSys for a fix date and interim guidance.
- Monitor affected machines for crashes or blue screens that may indicate exploitation.
- Rate the risk higher than the CVSS score on shared, public-access or kiosk PCs.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Element2023H/CVE-2026-120232
Research sources
- VulDB vulnerability entry vuldb.com
- VulDB CVE record vuldb.com
- OffSeq threat radar entry radar.offseq.com
- Horizon DataSys Reboot Restore Standard 13 release notes horizondatasys.com
- Reboot Restore Standard v13 user guide horizondatasys.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:21.
Original description (NVD)
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.