Description

A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kernel Driver. This manipulation causes improper privilege management. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-31T16:19:19.880Z",
  "pubdate": "2026-08-31T16:19:19.880Z",
  "executiveSummary": "A vulnerability involving improper privilege management exists in the ieungSoft Ultra RAMDisk Pro 1.82 kernel driver, URDSCSI.sys.\nThis local vulnerability allows an unprivileged attacker to escalate privileges by interacting with the driver's IOCTL interface.\nThe vulnerability resides within the kernel-mode driver, facilitating unauthorized execution or access at the SYSTEM level.\nThe flaw stems from a lack of adequate validation or access control enforcement within the kernel driver's internal processing routines.\nExploitation requires local access to the target system; however, public disclosure of a functional exploit significantly increases the risk.\nGiven that the vendor has failed to respond to disclosures, users are at ongoing risk of exploitation without a provided patch or remediation path.",
  "technicalDetails": "The vulnerability is identified within the URDSCSI.sys kernel driver, which is a component of the ieungSoft Ultra RAMDisk Pro 1.82 software suite. The driver operates at ring 0, where it is responsible for managing low-level virtual disk I/O operations.\nThe root cause is improper privilege management during the processing of IOCTL (Input/Output Control) requests. The driver fails to adequately validate or restrict requests originating from user-mode applications. Specifically, the component does not verify that the calling process possesses the necessary integrity levels or security tokens before performing privileged operations on behalf of the user.\nAn attacker can exploit this by crafting a malicious application that communicates with the driver via device handles. By sending specifically formatted IOCTL requests to the URDSCSI.sys device object, the attacker triggers an unsafe code path within the kernel driver. This process bypasses standard Windows access control mechanisms, allowing the malicious user-mode application to execute arbitrary code or perform sensitive operations within the context of the kernel.\nThe exploitation flow follows these steps: first, the attacker gains initial, restricted access to the local machine. Second, the attacker interacts with the driver by opening a handle to the device exported by URDSCSI.sys. Third, the attacker sends an IOCTL command designed to exploit the lack of input validation or the improper enforcement of kernel-mode privileges. Finally, the driver processes this request with elevated authority, leading to the successful elevation of privileges to SYSTEM level.\nPost-exploitation, the attacker gains full control over the host system, as the kernel-mode execution context permits the modification of system structures, disabling of security controls, or extraction of credentials from memory. Since the driver itself is signed or otherwise trusted by the operating system, it facilitates a bypass of kernel-level integrity protections. The lack of vendor response means no official patch exists for this component, leaving the vulnerable driver active on the system."
}