CVE-2026-120232: Memory Corruption in Reboot Restore Kernel Driver

CVE-2026-120232 is a memory corruption vulnerability in the kernel driver shield.sys of Horizon DataSys Reboot Restore Standard up to version 13.2. The flaw resides in function sub_23908 of the kernel driver component and allows a local attacker to corrupt memory and escalate privileges. It affects environments running vulnerable versions of the Reboot Restore suite.

The vulnerability rates CVSS 8.8 (HIGH). The exploit is publicly available according to official NVD description; signals on X confirm public availability of proof-of-concept material. The attack is local in nature and requires system access. The vendor has stated that a fix is planned for the next release but is not yet available. Recent social signals (last days) indicate the security community is already discussing this issue.

For defenders: prioritize updating to a version higher than 13.2 as soon as it becomes available. In the interim, strictly limit physical and local access to systems running Reboot Restore Standard through access controls and segregation.

Monitor kernel driver logs for memory anomalies and crashes. Review privileged local access and apply least privilege principles. Consider temporarily disabling non-critical driver features if patches are not yet available. Monitor official Horizon DataSys advisories for updates on fix availability.