Description

cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-27T10:16:39.810Z",
  "pubdate": "2026-08-27T10:16:39.810Z",
  "executiveSummary": "CodeMeter Runtime contains a critical vulnerability related to insecure file handling during the execution of cmu.exe with the --create-io --file C: parameters.\nThe vulnerability is classified as an improper check for NTFS reparse points, which allows for unauthorized file system operations.\nBecause the application executes with SYSTEM-level privileges, a local attacker can exploit this flaw to perform arbitrary file deletions, potentially leading to local privilege escalation (LPE).\nThe attack is localized, requiring an attacker to have the ability to create file system objects within the targeted directory path. The risk is high due to the potential for SYSTEM-level file manipulation, which could destabilize the OS or facilitate further exploitation of the host machine.",
  "technicalDetails": "The vulnerability resides within the file creation routine of cmu.exe. When the --create-io --file C: flag is invoked, the application attempts to initialize a file within the C:\\CM-Stick directory without validating the integrity of the target path.\nThe root cause is a race condition or logic flaw where the application fails to verify if the target directory or the resulting file path has been manipulated into an NTFS reparse point, such as a symbolic link or a junction point.\nAn attacker can exploit this by pre-creating the C:\\CM-Stick directory (if permissions allow) or by targeting the expected file path. By placing a junction point at the location where cmu.exe expects to create its temporary file, an attacker can redirect the file operation to an arbitrary location on the system.\nThe exploitation flow is as follows: 1) The attacker identifies that cmu.exe executes with SYSTEM privileges and targets a predictable path (C:\\CM-Stick). 2) The attacker creates a directory junction at C:\\CM-Stick pointing to a sensitive system directory or file (e.g., System32 configuration files or critical service binaries). 3) The attacker executes cmu.exe with the --create-io --file C: arguments. 4) The application, running as SYSTEM, follows the junction and performs file operations on the redirected path.\nSince the process runs as SYSTEM, the file system driver honors the reparse point, allowing the process to perform deletions or write operations on files that the attacker would normally not have permission to access. This capability can be leveraged to delete system files, corrupt security descriptors, or remove critical integrity checks, providing a pathway for privilege escalation or full system compromise.\nThere is no requirement for remote network access; this is a local attack vector requiring low-level file system access on the host. The lack of proper validation of the destination path (specifically checking for reparse points using APIs like GetFinalPathNameByHandle or by checking file attributes for IO_REPARSE_TAG_MOUNT_POINT) facilitates the malicious redirection of the privileged process."
}