This vulnerability involves a supply chain compromise of AVB Disc Soft's DAEMON Tools Lite installation packages for Windows versions 12.5.0.2421 through 12.5.0.2434. Attackers gained unauthorized access to the vendor's build or distribution infrastructure and inserted malicious code into three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These trojanized binaries were signed with the legitimate code-signing certificate, allowing them to appear trustworthy and bypass signature-based security controls. The affected installers were distributed from the official daemon-tools.cc website between approximately April 8, 2026, and May 5, 2026. The CVSS 4.0 base score is 9.3, reflecting critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and no exploits in the wild have been reported.

The impact of this vulnerability is critical due to the supply chain compromise allowing attackers to distribute trojanized, digitally signed binaries that can bypass signature-based detection. This can lead to unauthorized code execution with the privileges of the installed software, potentially compromising system confidentiality, integrity, and availability. The affected versions are DAEMON Tools Lite 12.5.0.2421 through 12.5.0.2434 distributed between April 8 and May 5, 2026. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or update is released by AVB Disc Soft, users should avoid installing or running DAEMON Tools Lite versions 12.5.0.2421 through 12.5.0.2434 obtained from the official website during the affected timeframe. Consider verifying the integrity of installation files and monitor vendor communications for updates. No official remediation or temporary fixes have been published as of now.