CVE-2026-12217: DVDFab Virtual Drive Signed Kernel Driver dvdfabio.sys privileges management

Synopsis

An improper privilege management vulnerability exists in DVDFab Virtual Drive 2.0.0.5, specifically within the signed kernel driver component dvdfabio.sys. The vulnerability is exploited locally by an attacker who already holds a low-privilege account on the affected system, requiring no interaction from another user. Successful exploitation allows the attacker to read sensitive data, tamper with system state, and crash or destabilize the host. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to reach the vulnerable driver.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; administrative credentials are not needed.

• Victim interactionNot required

  The exploit executes without requiring any action from another user on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental factors are required.

Blast Radius

• A successful attacker reads sensitive data accessible to the kernel driver, including credentials, tokens, or process memory from other applications running on the host.
• The attacker modifies kernel-level or system state, enabling persistence, privilege escalation to SYSTEM, or tampering with security controls on the host.
• The attacker crashes or destabilizes the host system, causing a denial of service that affects all workloads running on that machine.
• Because the vulnerable component is a signed kernel driver, exploitation bypasses user-mode security boundaries entirely, giving the attacker a foothold at the kernel layer.