EUVD-2026-73697
GHSA-wvgw-4gxf-j522
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Kernel driver exploitation requires only a low-privileged local session; AC:L because no special heap layout or race condition is described; full CIA reflects SYSTEM-level code execution.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows VOLSNAP.SYS allows an authorized attacker to execute code locally.
AnalysisAI
Heap-based buffer overflow in the Windows Volume Shadow Copy driver (VOLSNAP.SYS) enables a low-privileged local attacker to execute arbitrary code at kernel privilege, achieving full system compromise (C:H/I:H/A:H). Affected scope spans virtually all supported Windows releases from Server 2012 through Windows 11 25H2 and Server 2025, making this a broad-footprint local privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid local user session on the target Windows system (PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 (High), characterizing this as a straightforward local privilege escalation: no special configuration is needed, complexity is low, and only a standard user session is required to trigger the overflow. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update corresponding to your Windows version, bringing each release to the minimum fixed build: Windows Server 2025/Windows 11 24H2 to build 10.0.26100.9445 (or 10.0.26100.33438 for Server 2025 full), Windows 11 25H2 to 10.0.26200.9445, Windows 11 26H1 to 10.0.28000.2954, Windows 11 23H2 to 10.0.22631.7582, Windows Server 2022 to 10.0.20348.5622, Windows Server 2019/Windows 10 1809 to 10.0.17763.9245, Windows 10 21H2 to 10.0.19044.7725, Windows 10 22H2 to 10.0.19045.7725, Windows Server 2016/Windows 10 1607 to 10.0.14393.9512, Windows Server 2012 R2 to 6.3.9600.23397, and Windows Server 2012 to 6.2.9200.26349. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately (within 24 hours) obtain the latest Windows patching guidance from Microsoft and identify all Windows Server 2012 R2 through 2025 and Windows 11 versions in your environment, prioritizing systems handling backup, snapshots, and recovery functions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today