Horizon DataSys Reboot Restore: Local privilege escalation in shield.sys (CVE-2026-120232)

A proof-of-concept (PoC) exploit has been released for CVE-2026-120232, a local privilege escalation (LPE) vulnerability in the shield.sys driver used by Horizon DataSys Reboot Restore. The vulnerability affects version 13.2 and earlier. An unprivileged local attacker can leverage this flaw to gain SYSTEM level access on affected Windows systems. The exploit is written in Rust and utilizes Windows APIs to interact with the vulnerable driver.

Impact

Successful exploitation allows a local user with low privileges to execute code with SYSTEM privileges, granting full control over the compromised host.

Recommendation

• Inventory all systems running Horizon DataSys Reboot Restore version 13.2 or earlier.
• Apply patches provided by the vendor immediately upon release.
• Implement strict access controls for local user accounts to prevent unauthorized execution of custom binaries.
• Monitor for unusual file execution in temp directories or user-writable locations that attempt to interact with system drivers.