---
id: CVE-2026-120232
title: >-
  Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908
  memory corruption
summary: >-
  A vulnerability was identified in Horizon DataSys Reboot Restore Standard up
  to 13.2. The impacted element is the function sub_23908 in the library
  shield.sys of the component Kernel Driver. Such manipulation leads to memory
  corruption. …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-119
vendor: Horizon DataSys
product: Reboot Restore Standard
affected:
  - reboot_restore_standard 13.0
  - reboot_restore_standard 13.1
  - reboot_restore_standard 13.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T14:31:44.961575Z'
exploitAvailable: true
published: '2026-11-01'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:31:53.615Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120232'
references:
  - url: 'https://vuldb.com/vuln/429591'
    label: >-
      VDB-429591 | Horizon DataSys Reboot Restore Standard Kernel Driver
      shield.sys sub_23908 memory corruption
  - url: 'https://vuldb.com/vuln/429591/cti'
    label: 'VDB-429591 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120232'
    label: CVE-2026-120232 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1001497'
    label: >-
      Submit #1001497 | Horizon DataSys Reboot Restore Standard v13.2 (and
      prior) Improper Input Validation
  - url: 'https://gist.github.com/Element2023H/a176865b1f4015e003620154f3ba103c'
tags:
  - cve.org
  - exploit-available
epss: 0.0023
epssPercentile: 0.13898
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Element2023H/CVE-2026-120232'
    - 'https://github.com/Element2023H/CVE-2026-120232-RUST-POC'
  checkedAt: '2026-11-07T18:07:35.554Z'
ingestedAt: '2026-11-05T19:30:42.664Z'
---

## Overview

A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.

## Affected

- `reboot_restore_standard 13.0`
- `reboot_restore_standard 13.1`
- `reboot_restore_standard 13.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.