Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
Affects Horizon DataSys Reboot Restore Standard v13.2 and prior, through a kernel driver whose device object has default permissions. No vendor rating or fix is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 19/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
Horizon DataSys Reboot Restore Standard, a product whose kernel driver component (shield.sys) is affected, contains a flaw that can corrupt memory. An attacker with local access to the system could exploit it, which may lead to crashes or unauthorized control over the affected system.
Read the original description
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
What to do
Check whether your setup matches what the bug needs.
Product version Horizon DataSys Reboot Restore Standard v13.2 and prior Device object created with the legacy IoCreateDevice API without restrictive security descriptors, so default ACLs let standard users open it Exploit must send IOCTL control code 0x96102014 with sub-control code 0xF0016 to reach the vulnerable functionWorkaround: The checked facts list no workaround or mitigation. Use the vendor's advisory for any guidance on limiting the affected driver until a fix is available.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- Horizon DataSys Reboot Restore Standard
13.0, 13.1, 13.2
Evidence 6
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120232
What does this mean?
A memory corruption bug in the shield.sys kernel driver lets a local user read and write arbitrary kernel memory. The advisory says this can be used to overwrite a process token and gain SYSTEM privileges.Source: github.com
Am I affected, and how do I check?
Product versions Horizon DataSys Reboot Restore Standard v13.2 and prior are listed. The setup involves a device object created with the legacy IoCreateDevice API without restrictive security descriptors, so standard users can open it. Check the installed Reboot Restore Standard version against v13.2.Source: github.com
What should I do about it?
The checked facts do not name a fixed version to upgrade to. Check the vendor's advisory or product updates for a fixed release.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data
What if there's no patch?
The checked facts list no workaround or mitigation. Use the vendor's advisory for any guidance on limiting the affected driver until a fix is available.Source: github.com