CVE-2026-8398

Published May 15, 2026

Last updated 17 days ago

Exploit known CVSS critical 9.3

Windows

Zero-day

Supply chain

DAEMON Tools Lite

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-8398 describes a supply chain attack that compromised official installation packages of DAEMON Tools Lite for Windows. Between approximately April 8, 2026, and May 5, 2026, attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure. They subsequently trojanized three binaries—DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe—which were then distributed via the legitimate daemon-tools.cc website. These malicious installers appeared trustworthy because the trojanized files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing them to bypass signature-based detection. The affected versions of DAEMON Tools Lite are 12.5.0.2421 through 12.5.0.2434.

Description: A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Source: vulnerability@kaspersky.com
NVD status: Analyzed
Products: daemon_tools

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Daemon Tools Lite Embedded Malicious Code Vulnerability
Exploit added on: May 27, 2026
Exploit action due: May 30, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

vulnerability@kaspersky.com: CWE-506

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:disc-soft:daemon_tools:12.5.1:*:*:*:lite:*:*:*",
            "matchCriteriaId": "F291E275-397E-40E4-8ABD-292B16A8C90E",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.