CVE-2026-8398

Attackers gained unauthorized access to AVB Disc Soft's software build or distribution infrastructure and modified (trojaned) three binary files: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. The modified files were then signed with the vendor's legitimate code-signing certificate, causing security systems relying on digital signature verification to treat them as trusted. The compromised packages were distributed from the official daemon-tools.cc domain from approximately April 8, 2026 to May 5, 2026.

Users who installed compromised software versions could have been infected with malicious code with full privileges resulting from execution of the signed installer — attackers could gain a high level of control over the victim's system, including access to sensitive data and the ability to further compromise the environment.

Immediately uninstall compromised versions (12.5.0.2421–12.5.0.2434) and install the version provided by the vendor after May 5, 2026 — according to information published on the vendor's blog (blog.daemon-tools.cc). Systems on which vulnerable versions were installed should be subjected to thorough security audits to detect any traces of compromise.

DAEMON Tools Lite for Windows versions 12.5.0.2421 to 12.5.0.2434, downloaded from the daemon-tools.cc domain from approximately April 8, 2026 to May 5, 2026

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.