CVE-2026-81572: CWE-59 Improper link resolution before file access ('link following') in wibu-systems-ag codemeter-runtime

CVE-2026-81572 is a CWE-59 improper link resolution vulnerability in Wibu-Systems-AG's CodeMeter Runtime. The affected versions (8.40 to <8.41a and 9.00 to <9.10) have a flaw in the cmu.exe utility when invoked with --create-io --file C:, which creates a predictable temporary file under C:\CM-Stick. The software does not verify whether the directory or file paths are NTFS reparse points (junctions or symbolic links) before performing file operations. Because CodeMeter Runtime runs with System privileges, an attacker with local access can exploit this to create a junction that redirects file operations to arbitrary system paths, potentially deleting files with elevated privileges and enabling local privilege escalation.

A local attacker can exploit this vulnerability to delete arbitrary files on the system with System privileges, which can lead to denial of service or local privilege escalation. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been documented in the provided data. Until a patch is available, restrict local access to systems running affected versions of CodeMeter Runtime and monitor for suspicious activity related to file operations under C:\CM-Stick.