Microsoft Windows CD-ROM File System Driver: Remote code execution

Summary

The Windows CD-ROM File System Driver contains an untrusted pointer dereference (CWE-822) that allows an unauthorized attacker to execute code over a network. The CVE record lists CVSS 9.8 with no user interaction, while Microsoft's data reportedly gives 8.8 with user interaction required, so the exact conditions are not yet confirmed. Affected are many supported and some older Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607 and Server 2016. Microsoft currently assesses exploitation as unlikely and no public exploit is known.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (builds before 10.0.14393.9612)
• Windows 10 Version 1809 (builds before 10.0.17763.9376)
• Windows 10 Version 21H2 (builds before 10.0.19044.7807)
• Windows 10 Version 22H2 (builds before 10.0.19045.7807)
• Windows 11 Version 23H2 (builds before 10.0.22631.7652)
• Windows 11 Version 24H2 (builds before 10.0.26100.9711)
• Windows 11 Version 25H2 (builds before 10.0.26200.9711)
• Windows 11 Version 26H1 (builds before 10.0.28000.3231)
• Windows 11 Version 26H2 (builds before 10.0.26300.9711)
• Windows Server 2012 and 2012 R2 (builds before 6.2.9200.26434 and 6.3.9600.23470)

Fixed in

• Install the October 2026 security updates for the affected versions from Microsoft.
• Windows 10 1607 / Server 2016: 10.0.14393.9612 or later
• Windows 10 1809: 10.0.17763.9376 or later
• Windows 10 21H2: 10.0.19044.7807 or later
• Windows 10 22H2: 10.0.19045.7807 or later
• Windows 11 23H2: 10.0.22631.7652 or later
• Windows 11 24H2: 10.0.26100.9711 or later
• Windows 11 25H2: 10.0.26200.9711 or later
• Windows 11 26H1: 10.0.28000.3231 or later
• Windows 11 26H2: 10.0.26300.9711 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later
• Windows Server 2022 and 2025 are not listed in the CVE record; verify the fixed builds on the MSRC page.

Workaround

Unknown. No vendor workaround or mitigation was found in the sources reviewed. Patching is the only confirmed fix.

Exploitation

• Publicly disclosed: No
• Exploited in the wild: No
• Microsoft exploitability assessment: Exploitation Unlikely
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• EPSS: approx. 0.008 to 0.009 (low)

Our recommendation

• Inventory all Windows systems, especially Windows 10 1607, Windows Server 2012/2012 R2/2016 and other listed builds.
• Patch affected systems in the next maintenance window; do not wait for exploitation.
• Verify the KB number and build on the MSRC page before deployment.
• Keep older systems off the internet and restrict inbound SMB and file-sharing traffic at the firewall.
• Re-check the NVD and MSRC CVSS vector to confirm the risk score.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-70275 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-70275 vulners.com
• Microsoft advisory mirror (Vulners): MS:CVE-2026-70275 vulners.com
• Rapid7 mirror (Vulners): CVE-2026-70275 vulners.com
• OpenCVE: CVE-2026-70275 app.opencve.io
• Tenable plugin 365471 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:43.