CodeMeter Runtime Temporary File Deletion via Junction

Executive Summary

CVE-2026-81572 is a local privilege escalation vulnerability in Wibu-Systems CodeMeter Runtime. The cmu.exe tool creates predictable temporary files in C:\CM-Stick without checking for NTFS reparse points like junctions or symbolic links. A local attacker can exploit this by creating a junction pointing to an arbitrary system path, enabling arbitrary file deletion with System privileges and potential privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of CodeMeter Runtime versions 8.x (8.40-8.41) or 9.x (below 9.10) using system inventory tools. Monitor for unusual file deletions in C:\CM-Stick or C:\Config.Msi. Look for unexpected junctions or symbolic links pointing to sensitive directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker to delete arbitrary files with System privileges, potentially leading to privilege escalation to SYSTEM level. Attackers could replace legitimate files with malicious ones, enabling SYSTEM-level code execution during system operations like login. The impact includes unauthorized system access and control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized system access, potentially compromising data confidentiality and integrity. For GDPR, it may result in unauthorized data access or processing. For HIPAA, it could allow unauthorized access to protected health information. Compliance violations may occur if systems are not properly patched.

Useful 0 Not Useful 0

Mitigation Strategies

Update CodeMeter Runtime to fixed versions: 8.x >= 8.41a or 9.x >= 9.10. Remove write permissions for untrusted users to C:\CM-Stick and C:\Config.Msi. Disable the CodeMeter service if not required. Monitor for suspicious file operations in these directories.

Useful 0 Not Useful 0