Windows VOLSNAP.SYS CVE-2026-69426

Requires a valid local user session on the target Windows system (PR:L, AV:L). No specific non-default configuration or feature enablement is described as a prerequisite; VOLSNAP.SYS is loaded by default on all Windows installations that support Volume Shadow Copy, which includes all affected versions. Exploitation is constrained to local access - remote unauthenticated exploitation is not possible given AV:L. No user interaction by a second party is required (UI:N). Limiting factors: the attacker must already have code execution in a low-privileged local context (e.g., via phishing, RCE in a web-facing process, or physical access to a logged-in session).

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High), characterizing this as a straightforward local privilege escalation: no special configuration is needed, complexity is low, and only a standard user session is required to trigger the overflow. The scope is unchanged (S:U) in the CVSS sense, though in practice gaining SYSTEM from a low-privileged account is operationally equivalent to a scope change in most threat models. There is no CISA KEV listing and no public exploit at time of analysis, which tempers urgency compared to a KEV-listed vulnerability with the same CVSS. EPSS data is not provided, so exploitation probability cannot be quantified beyond the structural risk. The breadth of affected versions - spanning over a decade of Windows releases - means remediation at scale is non-trivial and a mid-sized IT team managing a diverse patch-level estate should treat this as a near-term patching priority. Missing signals: EPSS score absent, no KEV confirmation, no public POC - risk is assessed primarily from structural factors (AC:L, PR:L, full CIA impact, ubiquitous footprint).

A low-privileged local user - for example, an employee workstation account or a compromised service account - crafts a malicious IOCTL request to the VOLSNAP.SYS driver, triggering the heap overflow and corrupting kernel memory structures. The attacker leverages the corruption to redirect kernel execution flow and runs shellcode at SYSTEM privilege, gaining full control of the machine. No public POC exists at time of analysis, but the low complexity rating (AC:L) indicates exploitation would not require advanced heap-shaping techniques.