ESET fixes a SYSTEM-level driver flaw in its Windows encryption

ESET fixes a SYSTEM-level driver flaw in its Windows encryption

29 October 2026: ESET has fixed CVE-2026-75882, a High severity flaw (CVSS v4.0 8.5) in ESET Endpoint Encryption and ESET Full Disk Encryption for Windows that lets a user with standard rights make a privileged kernel driver carry out requests as SYSTEM. The fixed builds are Endpoint Encryption 5.4.29.0 and Full Disk Encryption 2.4.8.0. ESET's advisory does not say whether the flaw has been used in attacks.

Not yet independently verified. This rests on ESET's own advisory, which lists the CVE as reserved and does not say whether the flaw has been exploited. We have not found an independent write-up yet. We will update this when it can be confirmed, and remove this note.

How a standard user reaches the driver

According to advisory CA9033, the encryption products install a kernel driver whose device interface did not check the caller's permissions properly. An attacker already on the machine with an ordinary account could open that interface and send crafted requests, which the driver then executed on the attacker's behalf with SYSTEM privileges.

ESET lists three outcomes: disclosure of sensitive disk metadata, coerced authentication to remote systems, and loss of access to the encrypted volume. The second is the one security teams tend to worry about, because forcing a machine to authenticate to a server the attacker controls is a common first step in relaying credentials across a Windows domain. The third turns a security product into a way to lock a user out of their own disk.

The flaw was reported by Chanhee Park and Hojun Lee of the Computer Systems Security Lab at Korea University, and ESET handled it through coordinated disclosure.

Builds to move to

Product (Windows)	Affected	Fixed
ESET Endpoint Encryption	5.4.23.0 and earlier	5.4.29.0 and later
ESET Full Disk Encryption	2.4.4.0 and earlier	2.4.8.0 and later

ESET recommends upgrading now or scheduling it soon. The builds are on eset.com and in the ESET Repository, which is where ESET PROTECT pulls them for managed rollouts. ESET adds that versions past their end of life under its support policy may not be listed, so an older build missing from the table should be treated as affected.

Rolling out a disk encryption update

Updating full-disk encryption software is more delicate than updating an agent. A failed upgrade on a machine that is mid-encryption or mid-decryption can leave a volume that needs recovery keys to open, so check that recovery material is escrowed and that machines are fully encrypted before pushing the new build, and stage the rollout to a pilot group first. Endpoint Encryption, the product line ESET bought as DESlock, also covers removable media and file encryption, so the same build carries the fix for those features.

ESET and its endpoint rivals

We list ESET and seven products in our endpoint protection category. The advisory is version 1.0, published and last updated on 29 October.

Sources

• ESET Customer Advisory CA9033 (2026-0019): Improper access control vulnerability in ESET Encryption products for Windows fixed, 29 October 2026