Executive brief
DVDFab Virtual Drive, a utility for mounting disc image files, contains a security flaw in its kernel driver. This vulnerability allows a standard user on a computer to bypass Windows security protections and gain unauthorized access to sensitive system registry keys. An attacker could exploit this to tamper with system configurations, gain persistent access to the machine, or view protected system data, potentially leading to full control over the affected computer.
Technical details
A local privilege escalation vulnerability exists in the DVDFab Virtual Drive signed kernel driver, dvdfabio.sys (version 1.5.1.0). The driver exposes a device interface (\\.\DVDFabIO) that implements registry proxy IOCTLs (0x222410 and 0x22240C). These IOCTLs use kernel-mode functions to open or create registry keys based on caller-provided paths without enforcing the caller's security context or access checks. The resulting kernel-opened handles are then inserted into the low-privileged caller's process handle table. This allows a standard user to obtain handles with high-level access (e.g., KEY_SET_VALUE) to protected hives such as HKLM\SAM or HKLM\SECURITY, bypassing Windows Access Control Lists (ACLs). As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- DVDFab Virtual Drive 2.0.0.5
Timeline
- 2026-06-15: advisory: Vulnerability disclosed via NVD and VulDB