Local Privilege Escalation Vulnerability in CodeMeter by Wibu Systems

CVE-2026-81572

What is CVE-2026-81572?

A vulnerability exists in the CodeMeter Runtime where it creates predictable temporary files under C:\CM-Stick. Due to improper checks for NTFS reparse points like junctions or symbolic links during file operations, a local attacker could exploit this flaw. By creating a junction at the temporary file location that redirects to an arbitrary system path, the attacker gains the ability to delete arbitrary files with System privileges. Since CodeMeter Runtime operates under these elevated rights, this creates a pathway for local privilege escalation that could compromise the integrity of the system.

References