What is the CVSS score of CVE-2026-7162?

CVE-2026-7162 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WinFsp are affected by CVE-2026-7162?

CVE-2026-7162 in WinFsp enables local user privilege escalation to SYSTEM level through an integer overflow, providing complete system access.

How to fix or mitigate CVE-2026-7162?

Within 24 hours: Inventory WinFsp deployments across the organization and identify systems running versions prior to v2.2B2. Within 7 days: Test WinFsp v2.2B2 in non-production environment; implement Windows Group Policy restrictions to minimize local user privileges on critical systems; enable Windows Event Log monitoring for privilege escalation events (4688, 4689, 4672). Within 30 days: Deploy WinFsp v2.2B2 to production systems upon vendor release; verify all systems have updated; audit local privilege restrictions organization-wide.

WinFsp CVE-2026-7162

EUVD-2026-43268 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-13 CSA

GHSA-rvg3-9f28-p29q

Buffer Overflow Integer Overflow Winfsp

7.8

CVSS 3.1 · Vendor: CSA

Severity by source

Vendor (CSA) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local, low-privileged user triggers a hard-to-hit integer overflow (AV:L/PR:L/AC:H) that crosses into kernel/SYSTEM (S:C) for full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (CSA).

CVSS VectorVendor: CSA

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 04:22 vuln.today

DescriptionCVE.org

Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.

AnalysisAI

Local privilege escalation to SYSTEM in WinFsp (Windows File System Proxy) stems from an integer overflow (CWE-190) that a low-privileged local user can trigger to achieve system-level access on the host. The flaw crosses a privilege boundary (CVSS scope change) and is fixed in release v2.2B2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical but the SYSTEM-level impact makes it a meaningful local escalation risk.

Technical ContextAI

WinFsp is an open-source Windows kernel/user-mode framework that lets developers implement file systems in user space, functioning much like FUSE on Linux; it underpins tools such as rclone mount, sshfs-win, and various backup/sync utilities that expose virtual drives. The affected component per the CPE cpe:2.3:a:winfsp:winfsp:*:*:*:*:*:*:*:* is the WinFsp software itself across unspecified versions prior to the v2.2B2 fix. The root cause is CWE-190 (integer overflow/wraparound), also tagged as a buffer overflow, meaning an arithmetic operation on attacker-influenced size or length values wraps past its bounds and leads to undersized allocation or out-of-bounds memory access. Because WinFsp bridges user-mode requests into a kernel-mode file system driver, an overflow in that path can corrupt kernel memory and yield SYSTEM-level control, consistent with the reported scope change.

RemediationAI

Vendor-released patch: WinFsp v2.2B2 - upgrade all WinFsp installations to this release or later, obtainable from https://github.com/winfsp/winfsp/releases/tag/v2.2B2, and review the CSA advisory at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-086. Because WinFsp is frequently bundled by third-party applications (rclone, sshfs-win, backup tools), also update or rebuild those dependents so they ship the patched driver rather than an older embedded copy. If immediate patching is not possible, reduce exposure by restricting which local users can install/invoke WinFsp-backed mounts and by uninstalling WinFsp on systems where no application requires it - with the trade-off that any tool depending on WinFsp virtual drives will stop functioning until it is restored and patched.