The Ultra RAMDisk Pro kernel driver contains a critical vulnerability that allows a local, unprivileged user to escalate privileges to SYSTEM level by bypassing registry access controls.

The vulnerability exists within the URDSCSI.sys kernel driver, which exposes a user-reachable control device (\.\UltraRAMDiskIOCTL). A standard local user can send specific IOCTL requests to this device to trigger arbitrary registry value writes in the kernel context, effectively bypassing Windows Access Control Lists (ACLs).

Successful exploitation of this flaw allows a standard user with local access to modify critical registry entries, such as those governing system services or COM server registrations. This can lead to full system compromise, the installation of persistent malicious code, and the total loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this high-severity vulnerability represents a significant risk to any workstation or server where this software is deployed.

Immediate Action: As no patch is currently available, administrators should immediately uninstall Ultra RAMDisk Pro 1.82 from all systems to eliminate the attack surface.

Proactive Monitoring: Monitor system logs for unauthorized access attempts to sensitive registry paths (e.g., HKLM\SOFTWARE, HKLM\SYSTEM) and anomalous activity originating from local user accounts.

Compensating Controls: If the software must remain in use, restrict physical and remote access to the affected systems to trusted personnel only, and implement strict endpoint detection and response (EDR) policies to flag suspicious IOCTL calls directed at the URDSCSI driver.

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher's write-up on winslow1984.com.

Given the availability of a public proof-of-concept and the lack of a vendor-provided fix, this vulnerability poses a severe and immediate threat to system integrity. Organizations should prioritize the removal of Ultra RAMDisk Pro until the vendor releases a secure version. Failure to act may allow malicious actors to achieve full administrative control over affected systems via simple, local registry manipulation.