{"id":"CVE-2026-75882","kind":"vulnerability","aliases":["CVE-2026-75882"],"related":[],"title":"ESET encryption products: standard users can reach privileged kernel driver","description":"An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests.","summary":"ESET Endpoint Encryption and ESET Full Disk Encryption let a local user with standard permissions reach a device interface of a privileged kernel driver. A crafted request sent through that interface can let the attacker act with kernel-level privileges.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ESET Endpoint Encryption for Windows","fixed":["5.4.29.0"],"affected":"<= 5.4.23.0","ecosystem":"vendor"},{"name":"ESET Full Disk Encryption for Windows","fixed":["2.4.8.0"],"affected":"<= 2.4.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["endpoint-encryption","eset","full-disk-encryption","kernel-driver","local-privilege-escalation","vendor","windows"],"not_affected_if":["product-not-installed"],"how_to_check":"Open the ESET Endpoint Encryption or ESET Full Disk Encryption client on Windows and read the installed version. Affected: Endpoint Encryption 5.4.23.0 and earlier, Full Disk Encryption 2.4.4.0 and earlier. Fixed: 5.4.29.0 and 2.4.8.0.","fix":"Upgrade ESET Endpoint Encryption for Windows to 5.4.29.0 or later, and ESET Full Disk Encryption for Windows to 2.4.8.0 or later. Download from eset.com or the ESET Repository.","status":"open","published_at":"2026-10-30T13:20:06+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:12+00:00","updated_at":"2026-10-30T13:33:19+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-30T13:32:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"ESET encryption products: standard users can reach privileged kernel driver","impact":"high","summary":"ESET Endpoint Encryption and ESET Full Disk Encryption let a local user with standard permissions reach a device interface of a privileged kernel driver. A crafted request sent through that interface can let the attacker act with kernel-level privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["eset","windows","endpoint-encryption","full-disk-encryption"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local standard user reaches privileged kernel driver and sends crafted requests","analyst_note":"Find the ESET advisory and the affected and fixed version ranges for ESET Endpoint Encryption and ESET Full Disk Encryption; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-75882 does not give them.","how_to_check":"- Check whether ESET Endpoint Encryption or ESET Full Disk Encryption is installed on the machine\n- Confirm the installed product version against the vendor advisory\n- unknown for exact affected version ranges, as the sources do not list them","plain_action":"","needs_analyst":true,"not_affected_if":["product-not-installed"],"who_is_affected":"Machines running ESET Endpoint Encryption or ESET Full Disk Encryption are exposed, and the attacker needs only a standard user account on that machine. The sources do not give affected version ranges or a fixed version, so the vendor advisory is needed to confirm exposure. Systems without these ESET products can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000719,"input_tokens":4105,"output_tokens":616,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the ESET advisory and the affected and fixed version ranges for ESET Endpoint Encryption and ESET Full Disk Encryption; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-75882 does not give them.","search":"'-2026':12A,15A '-75882':13A,16A 'access':88C,106C 'act':80B 'allow':100C 'attack':79B,101C 'belong':110C 'control':89C 'craft':70B,119C 'cve':11A,14A 'devic':62B,108C 'disk':24A,34B,51B,98C 'driver':10A,38B,68B,115C 'encrypt':2A,30B,35B,47B,52B,94C,99C 'encryption':19A,25A 'endpoint':18A,29B,46B,93C 'endpoint-encrypt':28B 'escal':42B 'eset':1A,17A,22A,31B,45B,49B,92C,96C 'for':20A,26A 'full':23A,33B,50B,97C 'full-disk-encrypt':32B 'improp':87C 'interfac':63B,75B,109C 'kernel':9A,37B,67B,83B,114C 'kernel-driv':36B 'kernel-level':82B 'let':53B,77B 'level':84B 'local':40B,55B 'local-privilege-escal':39B 'permiss':59B,105C 'privileg':8A,41B,66B,85B,113C 'product':3A 'reach':7A,60B 'request':71B,120C 'send':117C 'sent':72B 'special':118C 'standard':4A,58B,103C 'user':5A,56B,104C 'vendor':43B 'vulner':90C 'window':44B 'windows':21A,27A","nicknames":[],"mitigations":[],"who_affected":"Windows machines with ESET Endpoint Encryption (5.4.23.0 and earlier) or ESET Full Disk Encryption (2.4.4.0 and earlier) installed. A local user with standard permissions can send crafted requests to a privileged kernel driver's device interface, and the driver runs them as SYSTEM. This can disclose disk metadata, coerce authentication to remote systems, or cause loss of access to the encrypted volume. Machines without these products are not affected.","tier":"B","verified":{"fix":{"at":"2026-10-30T13:33:19Z","by":"analyst","doc":"https://help.eset.com/changelogs/","run_id":1158},"products":{"at":"2026-10-30T13:33:19Z","by":"analyst","doc":"https://help.eset.com/changelogs/","run_id":1158},"how_to_check":{"at":"2026-10-30T13:33:19Z","by":"analyst","doc":"https://help.eset.com/changelogs/","run_id":1158},"who_affected":{"at":"2026-10-30T13:33:19Z","by":"analyst","doc":"https://help.eset.com/changelogs/","run_id":1158}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T13:20:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@eset.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75882","severity":null,"published_at":"2026-10-30T13:20:06+00:00","modified_at":"2026-10-30T13:20:06+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-75882:1158","url":null,"severity":null,"published_at":"2026-10-30T13:33:19+00:00","modified_at":"2026-10-30T13:33:19+00:00","first_seen_at":"2026-10-30T13:33:19+00:00","fetched_at":"2026-10-30T13:33:19+00:00","note":"Read ESET CA9033 (Oct 29 2026): CVSS 4.0 8.5, local standard user to SYSTEM via kernel driver interface. Affected/fixed versions from vendor page; changelog confirms EEE 5.4.29.0 fix. No exploitation or PoC reported; social posts not searched (fresh disclosure). Builds between listed affected and fixed versions are not addressed by ESET."}],"documents":[{"id":23704,"url":"https://support.eset.com/en/ca9033","title":"[CA9033] ESET Customer Advisory: Improper access control in ESET Encryption products for Windows","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":23705,"url":"https://help.eset.com/changelogs/","title":"ESET changelogs (EEE 5.4.29.0 fixes CVE-2026-75882)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}