TI-2026-83625 Aliases CVE-2026-120232 GHSA-4wxp-49m2-xx54

Memory corruption in Horizon DataSys Reboot Restore Standard driver

HIGH 75CWE-119Published 2026-11-01 · Updated 2026-11-02

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Horizon DataSys Reboot Restore Standard up to 13.2 is affected. The function sub_23908 in the kernel driver shield.sys contains a memory corruption flaw (CWE-119). A local user with low privileges can trigger the memory corruption. A public exploit is available and might be used.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0023 13th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Horizon DataSys	Reboot Restore Standard	13.0; 13.1; 13.2	—	No fix listed	CNA

Reboot Restore Standard VendorHorizon DataSys Affected 13.0; 13.1; 13.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:horizon_datasys:reboot_restore_standard::::::::	—	—	—

cpe:2.3:a:horizon_datasys:reboot_restore_standard:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for Horizon DataSys Reboot Restore Standard. The vendor plans a fix in an upcoming release.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

2026-11-01 Threatist record created from CVE-2026-120232
2026-11-01 Alias added: GHSA-4wxp-49m2-xx54
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: MEDIUM → HIGH

References

Exploit 1

https://gist.github.com/Element2023H/a176865b1f4015e003620154f3ba103c

TI-2022-15214 A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. CVSS 3.1MEDIUM 6.7
TI-2025-21134 In Rollback Rx Professional 12.8.0.0, the driver file shieldm.sys allows local users to… CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences