CVE-2026-81572 in CodeMeter Runtime
Summary
by MITRE • 08/27/2026
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in cmu.exe involves a classic insecure temporary file creation flaw where the application fails to validate NTFS reparse points such as junctions or symbolic links prior to performing file operations. Specifically, when invoked with the create-io flag and targeting the root of the C drive, the utility generates predictable temporary files within the C:\CM-Stick directory. This predictability combined with the lack of path validation allows a local attacker to manipulate the filesystem structure by creating a junction point at the expected location of the temporary file that redirects to an arbitrary system path. Since CodeMeter Runtime executes with System privileges, any operation performed on this redirected target is carried out under these elevated permissions, effectively granting the attacker control over high-privilege file operations including deletion or modification of critical system files.
From a technical perspective, this flaw represents a significant deviation from secure coding practices regarding temporary file handling and path canonicalization. The application does not employ mechanisms such as CreateFile with FILE_FLAG_OPEN_REPARSE_POINT to detect symbolic links or junctions, nor does it verify that the final resolved path remains within an expected safe directory. This oversight aligns directly with CWE-377 which describes insecure temporary file creation, particularly when combined with CWE-22 involving improper limitation of a pathname to a restricted directory. The predictability of the filename further exacerbates the risk by reducing the complexity required for an attacker to successfully race or overwrite the target location before the legitimate application writes its data.
The operational impact of this vulnerability is severe due to the privilege level at which CodeMeter Runtime operates. An authenticated local user can exploit this flaw to delete arbitrary files with System privileges, potentially leading to denial of service conditions by removing essential system components or configuration files. More critically, if an attacker can manipulate file creation in a way that allows for code execution or configuration tampering, it could facilitate local privilege escalation. By replacing critical binaries or scripts with malicious counterparts and leveraging the elevated context of CodeMeter Runtime, an attacker may gain full control over the operating system. This scenario is consistent with ATT&CK technique T1074 which covers data staged in temporary locations for later exfiltration or execution, although here it is adapted to facilitate destructive actions rather than just staging.
Mitigation strategies must focus on hardening the application's interaction with the filesystem and restricting its operational scope. Developers should implement strict path validation that resolves all symbolic links and junctions before performing any file operations, ensuring that the final destination remains within an allowed directory tree. Utilizing secure temporary file creation APIs such as CreateFileW with appropriate flags to prevent reparse point following is essential. Additionally, applying the principle of least privilege by running CodeMeter Runtime under a restricted user account rather than System would significantly reduce the impact of any successful exploitation. Regular security audits and static code analysis focused on CWE-377 patterns can help identify similar vulnerabilities in other components of the software suite before they are deployed to production environments.