Buffer overflow in Horizon Datasys Reboot Restore Standard
CVE-2026-120232
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.
Vulnerability class: Buffer Overflow
Published .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Horizon Datasys Reboot Restore Standard — versions 13.0, 13.1, 13.2
Weakness classification (CWE)
References
- gist.github.com/Element2023H/a176865b1f4015e003620154f3ba103c (exploit)
- vuldb.com/cve/CVE-2026-120232 (third-party-advisory)
- vuldb.com/submit/1001497 (third-party-advisory)
- vuldb.com/vuln/429591 (technical-description, vdb-entry)
- vuldb.com/vuln/429591/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-120232?
- CVE-2026-120232 is a high-severity vulnerability in Horizon Datasys Reboot Restore Standard, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.8/10. Published 2026-11-01.
- How severe is CVE-2026-120232?
- High severity. CVSS v3 base score is 8.8 out of 10.