EUVD-2026-43844
GHSA-2vv6-fvmm-g8r3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local kernel driver reachable with a standard user account; type confusion yields high confidentiality via memory read with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.
AnalysisAI
Type confusion in the Windows Composite Image File System (CimFS) kernel driver enables local, low-privileged authenticated users to disclose protected memory contents on widely-deployed Windows 10, Windows 11, and Windows Server platforms. The flaw (CWE-843) causes the driver to access a kernel resource via an incompatible type, resulting in unintended memory reads with high confidentiality impact. No public exploit or active exploitation has been confirmed - SSVC lists exploitation as 'none,' EPSS stands at 0.29% (21st percentile), and the vulnerability is absent from the CISA KEV catalog - placing real-world risk in the lower-medium tier despite the C:H CVSS sub-score.
Technical ContextAI
CimFS (Composite Image File System) is a Windows kernel-mode driver (cimfs.sys) introduced for Windows container image layer management, present by default on Windows 10, Windows 11, and Windows Server 2022/2025. CWE-843 (Type Confusion) occurs when the driver incorrectly interprets the type of a resource it accesses - for example, treating a memory object as a different structure type than it actually is - causing the kernel to follow a pointer or dereference memory relative to the wrong layout. This class of bug routinely enables out-of-bounds reads within the kernel address space. The affected CPE strings span cpe:2.3:a:microsoft:windows_10_version_21h2, windows_10_version_22h2, windows_11_version_24h2, windows_11_version_25h2, windows_11_version_26h1, windows_server_2022, and windows_server_2025, confirming this is a driver-level flaw across Microsoft's current mainstream release surface rather than an isolated edition-specific issue.
RemediationAI
Apply the Microsoft security update available via Windows Update, WSUS, or the Microsoft Update Catalog, referencing the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50381. The vendor-confirmed fixed builds are: Windows 10 21H2 → 10.0.19044.7548; Windows 10 22H2 → 10.0.19045.7548; Windows 11 24H2 → 10.0.26100.8875; Windows 11 25H2 → 10.0.26200.8875; Windows 11 26H1 → 10.0.28000.2269; Windows Server 2022 → 10.0.20348.5386; Windows Server 2025 and Server Core → 10.0.26100.33158. No vendor-documented workaround is available, and disabling CimFS systemwide would break Windows container functionality - organizations relying on containers should treat patching as the only viable remediation path. Given the local-only vector, prioritize systems where untrusted or shared-access users operate (VDI, RDS, Kubernetes nodes) before single-user workstations.
More in Windows 10 Version 21H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today