CVE-2026-12786 Details

A local privilege escalation vulnerability has been identified in Ezbsystems UltraISO Premium Edition versions through 9.76. The issue resides in the kernel driver bootpt64.sys, which improperly manages access controls. This vulnerability allows a low-privileged user to exploit raw disk read and write operations via the BootPart device, bypassing standard Windows access checks. The exploitation can lead to unauthorized access to protected file resources or manipulation of raw disk data, with potential escalation to higher privileges.

To address this vulnerability, do not grant generic access to the BootPart control device for Builtin Users. Instead, restrict access to SYSTEM and Administrators, or manage private disk operations through a trusted service. Ensure that normal Windows access checks are enforced before opening raw disk objects, and remove public raw disk read/write support from the device interface unless absolutely necessary. Additionally, implement explicit authorization checks for the mount IOCTL and any read/write operations that involve raw disk handles, treating write actions as sensitive and requiring administrative oversight, even for removable or image-backed disks.