Windows VOLSNAP.SYS CVE-2026-69420

The attacker must possess a valid local user account with the ability to execute code on the target Windows system (PR:L). No elevated privileges, special group membership, or administrative rights are required prior to exploitation. The Volume Shadow Copy driver is loaded by default on all affected Windows editions and does not require any non-default configuration to be present. Exploitation is limited to local access - remote network exploitation is not possible (AV:L). There is no user-interaction requirement (UI:N). The primary limiting factor is the need for a pre-existing local code execution foothold; this vulnerability is a privilege-escalation step, not an initial-access vector.

The CVSS 7.8 High score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a well-understood local privilege escalation class: an attacker who has already obtained a foothold on a Windows machine - via phishing, RDP brute force, or lateral movement - can reliably escalate to SYSTEM with no further interaction. The AC:L rating implies no race condition or unusual pre-requisite, making the path to privilege escalation straightforward once local code execution is achieved. No EPSS score or KEV entry was provided in the available intelligence, and no public POC has been identified, so exploitation probability in opportunistic campaigns cannot be independently quantified. The vast deployment footprint of affected Windows versions means that organizations with delayed patch cycles face elevated aggregate risk. Microsoft MSRC is the confirmed source, and fix builds are available across all listed product lines. Patch deployment should be treated as high priority given the kernel-level impact, the low bar for exploitation post-compromise, and the breadth of affected versions.

An attacker who has gained a low-privileged local user session on an unpatched Windows machine - for example, through credential theft or exploitation of a remote vulnerability - submits a specially crafted request to VOLSNAP.SYS, triggering the heap overflow in the Volume Shadow Copy driver. The overflow corrupts adjacent kernel heap metadata, enabling the attacker to redirect execution to attacker-controlled code running in kernel mode, and thereby obtain SYSTEM-level privileges. No public proof-of-concept has been identified at time of analysis, but the AC:L rating suggests the exploitation path is mechanically straightforward for an attacker with kernel exploitation experience.