Privilege Escalation in PowerISO Kernel Driver

Executive Summary

CVE-2026-19189 is a local privilege escalation flaw in PowerISO 9.3.0.0. It involves the signed kernel driver scdemu.sys, which exposes vulnerable IOCTLs allowing arbitrary registry writes or deletions in protected HKLM locations. This bypasses Windows registry permissions, enabling low-privileged users to modify critical system configurations.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the vulnerable driver file at C:\Windows\System32\drivers\scdemu.sys. Use Process Explorer or similar tools to inspect loaded drivers and verify if scdemu.sys is active. Monitor for unusual registry modifications in HKLM by reviewing audit logs or using tools like reg query commands.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could exploit this to modify service settings, hijack COM servers, tamper with LSA policies, or create persistence mechanisms. This could lead to SYSTEM-level code execution, giving full control over the affected system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily enables local privilege escalation, allowing attackers to gain SYSTEM-level access on affected systems. For compliance standards like GDPR or HIPAA, which require strict access controls and protection of sensitive data, this flaw could undermine security measures by enabling unauthorized modifications to system configurations, registry settings, or service permissions. Unauthorized privilege escalation may lead to data breaches or unauthorized access to protected health or personal information, violating compliance requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or uninstall PowerISO 9.3.0.0 to remove the vulnerable driver. Restrict access to the device object \\.\SCDEmuDev0 by modifying its ACLs. Block or monitor IOCTLs 0x80002018 and 0x8000201C using endpoint protection tools. Apply least-privilege principles to user accounts to limit local access.

Useful 0 Not Useful 0