CVE-2026-8398

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-506

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
May 27, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-839807.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839817.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839827.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839837.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839857.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839867.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839877.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839887.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-839897.5Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network.CVE-2026-839907.8Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.CVE-2026-839915.5Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering loCVE-2026-839928.8Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
CVE-2026-8398: Critical severity, CVSS 9.8 | Vulnix