Windows CVE-2026-40380

Exploitation requires two compounding prerequisites confirmed by the CVSS vector: physical access to the target device (AV:P) and high-privilege credentials on that system (PR:H per CVSS). The SSVC Automatable: no rating confirms this cannot be triggered remotely, through phishing, or via network-accessible interfaces. No user interaction is required beyond the attacker's own actions (UI:N), meaning the attack is self-contained once the two prerequisites are met. What limits exploitation: the attacker cannot operate remotely, cannot leverage low-privilege accounts, and cannot automate delivery across a network. Scope is unchanged (S:U), so the overflow does not propagate to adjacent hypervisors or containers without additional exploitation steps. This vulnerability is irrelevant to remote attack scenarios and poses no risk in environments where strict physical access controls and separation of high-privilege accounts from physical access are enforced.

Despite the SSVC classification of Technical Impact: total - consistent with a kernel code execution primitive - the aggregate real-world risk is low for most environments. The CVSS AV:P (physical) and PR:H (high privileges) metrics impose compounding prerequisites: the attacker must be physically present at the device and already hold high-privilege credentials, two conditions that together dramatically constrain the viable attacker population. EPSS at 0.07% (22nd percentile) is consistent with these constraints and indicates essentially no observed exploitation activity in the wild. SSVC also confirms Automatable: no, ruling out remote scanning, worm propagation, or mass exploitation. The vulnerability is absent from CISA KEV and no public proof-of-concept has been identified. The primary residual risk is insider threat scenarios or physical-access supply chain attacks. Organizations with kiosk deployments, shared physical terminals, or regulated environments requiring strict physical security postures should treat this with higher urgency than general enterprise endpoints.

An insider or physically present attacker authenticates to a Windows system with high-privilege credentials, then interacts with the Volume Manager Extension Driver through a crafted storage operation, triggering the heap buffer overflow to overwrite critical kernel data structures and redirect execution to attacker-controlled code. This scenario is most plausible in contexts such as a rogue IT administrator with physical console access, an attacker who has seized physical control of an unattended privileged workstation, or a supply chain actor with access to hardware before deployment. No public proof-of-concept code has been identified at time of analysis.