Windows Volume Manager CVE-2026-85356

Exploitation requires the attacker to already have local, authenticated access to the Windows host and the ability to execute code as at least a low-privileged user (PR:L, AV:L) - there is no remote or network-reachable path and no user interaction is needed once local code runs (UI:N). The trigger is interaction with the Windows Volume Manager Extension Driver (volmgrx), which is present by default on all supported Windows client and server editions, so no non-default feature or configuration must be enabled. The principal limiting factors are the mandatory local foothold and existing authenticated privileges, which is why CISA SSVC marks it Automatable=no and not suitable for mass/remote exploitation.

This is a locally-exploitable elevation-of-privilege flaw whose signals are internally consistent but point to moderate, not emergency, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already have local, low-privileged authenticated access and run code on the host - there is no remote or unauthenticated path, which is the single biggest limiting factor despite the 7.8 'High' score. CISA's SSVC framing agrees: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass-scripted across the internet precisely because it needs local access), yet Technical Impact=total, matching the C:H/I:H/A:H kernel-level compromise. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV and shows no POC, so the probabilistic and real-world-exploitation signals are absent/low rather than conflicting. Net: a genuine but second-tier patch priority - valuable to an attacker as a post-compromise local privilege-escalation link in a chain, not a perimeter-breaking issue. Prioritize for standard Patch Tuesday remediation on multi-user, RDP, and shared/terminal-server hosts where untrusted local code is most likely to run.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing, a compromised standard user account, or a prior RCE) runs a crafted program that triggers the out-of-bounds read in the Volume Manager Extension Driver to corrupt or disclose kernel memory and elevate to SYSTEM. No public exploit code was identified at time of analysis, so weaponization would require original exploit development. Because the CVSS vector is AV:L with UI:N, exploitation is fully local and needs no victim interaction once code execution is achieved.