Windows Volume Shadow Copy CVE-2026-72985

Physical access to the target machine is required (CVSS AV:P) - this is the single most important limiting condition. No authentication credentials are required (PR:N), meaning the attacker does not need a valid Windows account before triggering the overflow; the attack is feasible from a pre-login state or via hardware-level interaction. No user interaction is needed (UI:N). Exploitation is not automatable over a network and cannot be performed remotely. The vulnerability applies across default configurations of all affected Windows and Windows Server editions listed; no special optional feature or non-default configuration is required beyond physical machine access. Defenders should assess risk against physical security posture: environments with strict physical controls (locked server rooms, secure workstations) face substantially lower real-world risk than shared-access or kiosk deployments.

Despite a CVSS score of only 6.8, the technical impact is total (SSVC: Technical Impact: total) - a successful exploit yields full system compromise (C:H/I:H/A:H). The score is moderated primarily by the physical attack vector (AV:P), which is the dominant risk-limiting factor: exploitation requires the attacker to be physically present at or connected to the machine. SSVC confirms Automatable: no and Exploitation: none, consistent with the physical constraint making mass or remote exploitation impossible. No EPSS data was provided in the input. The absence of a KEV listing and no public POC further support a lower operational urgency for networked environments. However, for deployment contexts with untrusted physical access - shared workstations, kiosks, publicly accessible terminals, insufficiently secured data center racks, or insider threat scenarios - the risk is material given the full privilege escalation outcome. The breadth of affected Windows versions (Server 2012 through Windows 11 26H1) means the attack surface is wide wherever physical controls are inadequate.

An attacker with physical access to an unpatched Windows machine - such as an insider, a person accessing an unattended workstation, or someone with unauthorized data center access - triggers the heap-based buffer overflow by directing crafted input through the Volume Shadow Copy Service subsystem. The corrupted heap state is leveraged to redirect code execution, escalating the attacker's privileges to SYSTEM level. No public exploit code has been identified at time of analysis, but the AC:L rating suggests exploitation mechanics are relatively straightforward once physical access is secured.