EUVD-2026-73566
GHSA-7qq5-rgv2-3r69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Windows account (PR:L)
-
DeliveryPresent crafted exFAT volume/image
-
ExploitDriver performs out-of-bounds read
-
ExecutionCorrupt kernel state / leak memory
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the vulnerable Windows exFAT file-system driver to parse attacker-controlled exFAT-formatted data - typically a crafted removable volume, disk image, or mounted filesystem. The attacker must already hold low-privileged authenticated access (PR:L) on an affected build (see EUVD ranges spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025); no user interaction (UI:N) and low complexity (AC:L) are involved. Limiting factors: valid local credentials are required, exploitation targets the exFAT code path (a system must actually process the malicious exFAT structure), and Microsoft's AV:N 'over a network' claim is unverified for a file-system parsing bug and should be confirmed with the vendor before assuming remote reachability. A vendor patch is available and is the definitive mitigation. |
| Impact | This is a Microsoft-rated CVSS 3.1 8.8 (High) elevation-of-privilege flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Windows exFAT file-system driver, stemming from an out-of-bounds read (CWE-125). The signals point to a genuine but not top-tier emergency: EPSS is low at 0.77% (53rd percentile), CISA's SSVC framework marks Exploitation as 'none' and Automatable as 'no' (while acknowledging Technical Impact as 'total'), and there is no public exploit identified at time of analysis and no CISA KEV listing. The most important caveat is a vector/description tension: the description says the attacker can 'elevate privileges over a network' and Microsoft assigns AV:N, yet an out-of-bounds read in a file-system parser is normally triggered by processing a crafted volume/image (local vector, AV:L). This AV:N is Microsoft boilerplate for file-system bugs and should be treated skeptically - verify the real delivery path with the vendor. The PR:L (authorized attacker) requirement and lack of automation/known exploitation mean this is a patch-in-normal-cycle priority rather than an out-of-band scramble, but the ubiquity of Windows and the kernel-level 'total' impact make it a firm must-patch across the fleet. |
| Exploit ScenarioDerived | An attacker who already has low-privileged authenticated access to a Windows host supplies a maliciously crafted exFAT-formatted volume or image (e.g., removable media or a mounted disk image) that, when parsed by the exFAT driver, triggers an out-of-bounds read in kernel context, leaking memory or corrupting driver state to escalate to SYSTEM. Per CVSS the complexity is low (AC:L) and no user interaction is required (UI:N), but valid low-level credentials (PR:L) are needed; no public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 21, 2026
Elevation of privilege in the Windows exFAT file-system driver allows an attacker who already holds low-privileged access to hand the kernel a malformed exFAT structure, triggering an out-of-bounds read (CWE-125) that can corrupt memory and yield SYSTEM-level execution (Microsoft CVSS 3.1 base 8.8; vector requires authenticated access, PR:L, with no user interaction). Affected builds span Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025, i.e. essentially the entire supported Windows fleet, which makes the low exploit-probability signal the main moderating factor. No public exploit code has been identified at time of analysis, EPSS is 0.77% (53rd percentile), and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total; a vendor patch is available. Note a vector discrepancy: Microsoft rates this AV:N ('over a network'), whereas independent assessment places it AV:L, since triggering requires a system to process attacker-controlled exFAT data and remote reachability for a file-system parsing bug is unverified.
Earlier versions of this analysis (1)
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
RemediationAI
Vendor-released patch: Microsoft lists this as available, and the definitive fix is the security update described in https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69619, which moves affected builds past the EUVD-listed thresholds - Windows 10 1607 and Server 2016 to 10.0.14393.9512 or later, Windows 10 1809 and Server 2019 to 10.0.17763.9245 or later, Windows 10 21H2 to 10.0.19044.7725 or later, Windows 10 22H2 to 10.0.19045.7725 or later, Windows 11 23H2 to 10.0.22631.7582 or later, Windows 11 24H2 to 10.0.26100.9445 or later, Windows 11 25H2 to 10.0.26200.9445 or later, Windows 11 26H1 to 10.0.28000.2954 or later, Server 2022 to 10.0.20348.5622 or later, Server 2025 to 10.0.26100.33438 or later, Server 2012 to 6.2.9200.26349 or later, and Server 2012 R2 to 6.3.9600.23397 or later. Because exploitation requires the driver to parse an attacker-supplied exFAT structure and requires existing low-privileged access, the practical compensating control is to stop untrusted exFAT volumes from reaching that parser: disable or block loading of the exFAT file-system driver on hosts that do not need it (for example by setting the driver's start value to disabled via the Services registry key) and prevent non-administrators from mounting arbitrary disk images or attaching untrusted removable media - the trade-off is that legitimate exFAT-formatted USB drives and images will no longer be usable on those systems. Server Core and hypervisor hosts that never mount exFAT media are the best candidates for that restriction, while multi-user and RDP/VDI endpoints, where a low-privileged user can plausibly supply the malicious volume, should be patched first; if Microsoft's AV:N designation is confirmed by the vendor, network paths that expose remote volumes for mounting should be segmented as an additional layer, but note that this AV:N claim is unverified for a local file-system parsing bug.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in Microsoft's kernel-mode exFAT file-system driver, the component that parses the exFAT on-disk format (boot region, FAT and allocation bitmap, cluster heap, and directory entry records) for removable media, disk images, and mounted volumes. CWE-125 (out-of-bounds read) indicates the driver trusts length, offset, or count fields from attacker-controlled on-disk metadata without adequately bounding them against the actual buffer, so a crafted volume or image causes the kernel to read past allocated memory; in a kernel context such reads frequently escalate into memory corruption and privilege escalation rather than a simple information disclosure. Because the code path executes at ring 0, whatever the parser mishandles runs with the highest privilege on the host, which is why Microsoft scores Confidentiality, Integrity, and Availability all High. Exploitation is gated by the requirement that the target actually process an attacker-supplied exFAT structure and that the attacker already hold valid low-privileged credentials (CVSS PR:L), and AC:L/UI:N mean no special conditions or user prompting are needed once those prerequisites are met. The CPE set covers Windows 10 1607, 1809, 21H2, and 22H2 across x86, x64, and arm64, with EUVD extending the affected inventory to Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
exFAT parsing bugs are triggered by processing a crafted local volume/image, so AV:L over the vendor's AV:N; PR:L for the required authorized user; kernel OOB read yields high C/I/A EoP.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Out-of-bounds read in Windows exFAT File System allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
The Windows exFAT file-system driver - shipped across the entire supported Windows fleet, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 - contains an elevation-of-privilege flaw that lets an authenticated low-privileged user corrupt kernel memory and obtain SYSTEM-level control of the machine. Because the affected builds cover essentially every endpoint and server we operate, a single compromised user account or unprivileged workload becomes a direct path to full host takeover and a likely precursor to lateral movement. No exploitation has been observed and a vendor fix exists, so this is a fleet-wide patching obligation rather than an emergency, but the breadth of exposure and total technical impact keep it firmly in leadership's view.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB