PowerISO 9.3.0.0 users on Windows should immediately address PowerISO CVE-2026-19189 , a local elevation of privilege vulnerability in the signed scdemu.sys driver . The vulnerability allows a simple local user to bypass normal registry checks.
The NVD entry for CVE-2026-19189 states that the attack requires local access, while available exploit code can be used in attacks. The rating comes from VulDB, and the page does not yet show a separate NVD rating.
See also: Zbtlink Routers: Backdoor in 20+ models opens root shell
What does PowerISO CVE-2026-19189 mean?
The vulnerability affects the scdemu.sys, version 6.9.0.0, which is installed with PowerISO 9.3.0.0. According to technical analysis by researcher Winslow, the driver exposes a device interface that is accessible to a typical user.
Through the \\.\SCDEmuDev0, two input-output commands allow writing or deleting selected registry objects. The wizard performs the tasks at the kernel level without imposing the restrictions that would apply to a direct action by the same user.
In testing, a non-administrator account was unable to modify protected locations under HKLM. However, the same operation was completed through the wizard, indicating that the problem is not a simple incorrect operating system configuration but rather the way the wizard handles requests.
How can weakness be exploited?
Writing to protected registry locations can, depending on the target, be used to change the startup path of a service, modify COM settings, or interfere with auto-execution mechanisms. The researcher does not present a ready-made chain for a remote attack, but describes the ability to transition from low privileges to run as SYSTEM after a reboot or service restart.
This limits the immediate scope of risk, but it is not negligible. An attacker who has already gained an account on a computer, a malicious program running with user rights, or an insider threat could exploit the driver to gain stronger control.
See also: Cruciferra Crypter: BYOVD and Process Ghosting to hide malware
The CVE entry describes the issue as improper rights management and lists a high impact on confidentiality, integrity, and availability when local access is combined with successful exploitation. This is not remote code execution: the attacker must first be able to perform actions on the same system.
However, having a signed driver makes the case more complex for defense. The digital signature verifies the origin of the file, not that each driver interface correctly implements access controls. Therefore, driver blocking rules must also be based on their behavior.
Detection checks should not be limited to a single point in time. Maintaining logs of driver loads, service changes, and registry access helps with retrospective investigation, particularly on workstations used for development or systems administration.
As of the time of publication, no patch appears to be available from Power Software Limited, and the technical report states that the manufacturer has not responded to the notification. Administrators should not take the absence of an update as an indication that version 9.3.0.0 is secure.
What should administrators do?
Until an official fix is available, organizations should identify installations of PowerISO 9.3.0.0 and examine whether the scdemu.sys is loaded. Temporarily uninstalling PowerISO or disabling the driver is the safest option for systems where virtual disk functionality is not required.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The audit can be combined with software and driver inventory to distinguish between computers that truly need PowerISO and those where it has been installed occasionally. In corporate environments, removing an unnecessary driver simultaneously reduces the attack surface and the number of items the security team has to monitor.
Security teams can also monitor for unexpected changes to services, startup keys, and protected registry locations. It is also useful to monitor when the SCDEmuDev by non-administrative accounts, and enforce policies that restrict the installation of unnecessary drivers.
See also: CatchPulse driver: Critical vulnerability CVE-2026-15506 in kernel driver
The SecNews technical team recommends that the affected version not be left installed unless operationally necessary and that unverified drivers be avoided. PowerISO CVE-2026-19189 is a local vulnerability, but the public technical documentation increases the importance of checking and addressing it immediately.
