Microsoft Windows: Elevation of privilege in CD-ROM driver

Summary

A buffer over-read in the Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges, according to the CNA record. The CNA describes the attack as possible over a network, but the research notes say no source confirms direct internet exposure of the driver, so an attacker likely needs an existing foothold. Sources disagree on the CVSS score (9.8 in the provided data and some feeds, 6.5 in others), so the severity is unresolved until NVD or MSRC confirms the vector.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612)
• Windows Server 2016 (10.0.14393.0 to before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9711)
• Windows Server 2012 (6.2.9200.0 to before 6.2.9200.26434)
• Windows Server 2012 R2 (6.3.9600.0 to before 6.3.9600.23470)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 or later
• Windows 10 Version 1809: 10.0.17763.9376 or later
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: 10.0.19045.7807 or later
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2 and 25H2, 26H2: 10.0.26100.9711 or later (25H2 and 26H2 per the CNA ranges)
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later
• Knowledge base numbers for Windows 10 Version 1607 are unknown. Verify the security update in the MSRC Security Update Guide or the Windows Update Catalog.

Workaround

Unknown. No workaround was found in the sources. Installing the Microsoft security update is the only documented remediation.

Exploitation

• No evidence of exploitation in the wild was found; the CISA SSVC assessment lists exploitation as none and not automatable.
• No public proof-of-concept exploit was found at the time of research. This is a point-in-time statement.
• EPSS is listed as below 1 percent.

Our recommendation

• Inventory all Windows 10 Version 1607, Windows Server 2016 and other affected systems, and prioritise legacy or unsupported machines such as kiosk, industrial or LTSB systems.
• Apply the Microsoft security update for CVE-2026-83888 in the next regular Windows update cycle, starting with Windows 10 Version 1607 and Windows Server 2016 hosts.
• If a system is out of support, check Microsoft's lifecycle page for Extended Security Updates or plan a replacement.
• Confirm the CVSS vector and score on the NVD or MSRC page before using a severity rating in change tickets.
• Limit local and remote logon to affected hosts and monitor for unexpected privilege changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• Vulners NVD record vulners.com
• Vulners MSCVE record vulners.com
• OpenCVE app.opencve.io
• VulDB vuldb.com
• Strix www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:33.