CVE-2026-69283

CVE-2026-69283 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows CD-ROM driver. A local attacker who is already authorized on the system with low-level privileges can trigger the flaw without any user interaction, corrupting memory in the driver. Successful exploitation allows the attacker to elevate privileges on the local machine, gaining execution above their current account's access level. Any Windows system running the affected CD-ROM driver component is affected; the available data does not specify particular Windows version ranges. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation within the next 30 days.

What to do: Apply Microsoft's security update for CVE-2026-69283 via Windows Update on your normal patch cycle, since no public exploit or KEV listing currently exists. Prioritize hosts that expose local logon to multiple or untrusted users (shared workstations, RDS/VDI servers, jump boxes), as exploitation requires existing local access. Verify remediation by confirming the Microsoft update appears in the machine's installed-update history.