EUVD-2026-29656
GHSA-3j8w-x6pf-m499
Severity by source
AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Physical presence required to reach the driver (AV:P), high privileges needed per 'authorized attacker' description (PR:H); successful heap overflow yields full kernel code execution with complete CIA impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
AnalysisAI
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.
Technical ContextAI
The Volume Manager Extension Driver is a kernel-mode Windows component responsible for managing logical storage volumes. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the driver fails to enforce proper bounds validation on heap-allocated memory, enabling a controlled heap corruption condition that can be leveraged to redirect execution flow. CPE data confirms the vulnerability spans the Microsoft Windows product family across multiple major release lines: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3 through 26H1; and Windows Server 2012 through Server 2025. The CVSS vector AV:P specifies that the exploit path requires physical access to the hardware, distinguishing this from network-reachable driver vulnerabilities.
RemediationAI
Apply the vendor-released patch via Windows Update or through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380. Per EUVD-2026-29656, fixed builds include Windows 11 24H2 at 10.0.26100.8457 or later, Windows 11 25H2 at 10.0.26200.8457 or later, Windows 11 26H1 at 10.0.28000.2113 or later, Windows 11 22H3/23H2 at 10.0.22631.7079 or later, Windows 10 21H2 at 10.0.19044.7291 or later, Windows 10 22H2 at 10.0.19045.7291 or later, Windows 10 1607 and Server 2016 at 10.0.14393.9140 or later, Windows Server 2019 at 10.0.17763.8755 or later, Windows Server 2022 at 10.0.20348.5139 or later, Server 2022 23H2 at 10.0.25398.2330 or later, Server 2025 at 10.0.26100.32860 or later, Server 2012 at 6.2.9200.26079 or later, and Server 2012 R2 at 6.3.9600.23181 or later. Where immediate patching is not feasible, enforce strict physical access controls - since the attack vector is entirely physical (AV:P), robust physical security (locked server rooms, chassis intrusion detection, BIOS/UEFI passwords, disabled USB/maintenance ports) directly and materially reduces exposure without software-level trade-offs.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today