Microsoft CVE-2026-26176

The Windows Client Side Caching driver (csc.sys) is a kernel-mode component responsible for offline file synchronization and caching network resources locally. This vulnerability stems from a heap-based buffer overflow (CWE-122), occurring when the driver improperly validates user-supplied input before copying data into a heap-allocated buffer. Because csc.sys operates in kernel space with SYSTEM privileges, successful exploitation allows an attacker to overflow the buffer with crafted data, overwriting adjacent memory structures to redirect execution flow or corrupt critical kernel objects. The local attack vector (AV:L) requires the attacker to already have authenticated access to the target system with low privileges (PR:L), positioning this as a second-stage attack following initial compromise. The vulnerability affects Windows kernel builds spanning over a decade of releases, from Windows Server 2012 (kernel 6.2) through the latest Windows 11 26H1 and Server 2025 (kernel 10.0.28000/26100), indicating a long-standing weakness in buffer handling logic within the CSC subsystem.