CVE-2026-12786: UltraISO Kernel Driver Privilege Escalation Vulnerability

Technical summary

CVE-2026-12786 is a privilege escalation vulnerability affecting the bootpt64.sys kernel driver component in UltraISO Premium Edition. The flaw stems from improper access control mechanisms (CWE-266: Improper Privilege Management and CWE-284: Improper Access Control) that allow a local authenticated user to execute arbitrary code with kernel privileges. The CVSS 3.1 score of 7.8 (HIGH) reflects the ease of exploitation (low complexity, no user interaction required) combined with significant impact on confidentiality, integrity, and availability. Exploitation requires local access with low-level user privileges but no special conditions.

Business impact

Organizations using UltraISO Premium Edition for disc image creation and management face a significant internal security risk. A compromised or malicious local user account could leverage this kernel driver vulnerability to escalate privileges, potentially compromising the entire system and any data it contains. In environments where UltraISO is used by multiple users or contractors, the risk surface expands proportionally. The vendor's non-response to early disclosure suggests no official patch timeline exists, creating operational uncertainty and extended exposure for organizations unable to immediately migrate.

Affected systems

Ezbsystems UltraISO Premium Edition versions up to and including 9.76 are confirmed vulnerable. The kernel driver component bootpt64.sys is the attack surface. Both 32-bit and 64-bit architectures appear to be in scope given the driver name. Verify your installation version through UltraISO's Help > About menu or by checking the bootpt64.sys driver properties in Windows.

Exploitability

The exploit has been publicly disclosed and is available to potential attackers. Exploitation requires local system access and low user privileges—a realistic threat model in shared systems, corporate environments with service accounts, or systems accessed by contractors. Once gained, local access combined with this kernel driver flaw provides direct privilege escalation with minimal friction, making this a practical attack vector that does not require sophisticated social engineering or zero-day-level complexity.

Remediation

Immediate mitigation options include: (1) Uninstall or disable UltraISO Premium Edition if operationally feasible; (2) Restrict UltraISO installation to trusted administrator accounts only and limit local user logon privileges; (3) Apply file-level and registry-level access controls to bootpt64.sys to prevent loading by unprivileged processes; (4) Monitor kernel driver loads and privilege escalation attempts via endpoint detection and response (EDR) tools. Contact Ezbsystems support to request a patched version or timeline. Verify any vendor response directly through official channels before updating.

Patch guidance

As of the published date (June 2026), the vendor has not responded to disclosure and no official patch is available. Do not assume patches beyond version 9.76 are safe without explicit vendor confirmation. Monitor Ezbsystems' official website and security advisories for updates. If a patch is released, test it in a controlled environment before broad deployment. Document the vendor's response timeline for compliance and risk reporting purposes.

Detection guidance

Monitor for: (1) Unauthorized attempts to load or interact with bootpt64.sys driver, particularly from non-administrator accounts; (2) Unexpected privilege escalation events following UltraISO activity; (3) Driver load events from unusual file paths or with modified timestamps; (4) File access attempts to bootpt64.sys from processes other than system components. EDR and kernel-level monitoring tools can flag suspicious driver interaction patterns. Windows Event Viewer logs (System channel) and Sysmon can capture relevant driver load and access events.

Why prioritize this

This vulnerability merits high-priority attention due to: (1) Published exploit availability enabling rapid weaponization; (2) LOCAL privilege escalation with HIGH impact (C, I, A all affected); (3) Vendor non-responsiveness eliminating the patch timeline option; (4) Realistic attack surface in organizations with multiple local users or service accounts. Affected organizations should remediate within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local privilege escalation with full system compromise potential. The vector (AV:L/AC:L/PR:L/UI:N/S:U) indicates low attack complexity and no user interaction required once local access is present. The impact ratings (C:H/I:H/A:H) show all three security pillars are compromised. In practice, risk is elevated further by public exploit availability and vendor non-response, making this a clear near-term threat requiring active management.

Frequently asked questions