Windows Volume Manager CVE-2026-85928

Exploitation requires the attacker to reach and send malicious input to the Windows Volume Manager Extension Driver; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction against affected default Windows installations. The practical limiting factor is the network-exposure path: a kernel volume/storage driver is not inherently internet-facing, so real-world exploitation likely depends on a specific service, protocol handler, or remote feature that forwards data to the driver - this exact reachable surface is not stated in the advisory and should be confirmed with Microsoft. Systems are limited to the enumerated vulnerable builds; patched builds (e.g., Windows 11 24H2 at or above 10.0.26100.9711, Server 2025 at or above 10.0.26100.33650) are not affected.

Multiple signals point to high priority, but they are not fully aligned. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, low-complexity, network-reachable remote code execution with total CIA impact (C:H/I:H/A:H), yielding a base score of 9.8 - worst-case on paper. CISA's SSVC framework corroborates maximum severity on two axes (Automatable: yes, Technical Impact: total), meaning a reliable exploit could be scripted for mass use. However, the SSVC Exploitation value is 'none', there is no CISA KEV listing, and no public POC is referenced, so this is a no-public-exploit-identified situation rather than active exploitation. A notable tension exists between the CVSS AV:N label and the nature of the component: the Windows Volume Manager Extension Driver is a low-level storage/volume driver not obviously exposed to the network, so 'execute code over a network' warrants verification of the exact remote-reachable path with Microsoft - the network vector may depend on a specific service or protocol fronting the driver. No EPSS score was provided, so statistical exploitation probability cannot be weighed. Net: treat as a top-tier patch priority given ubiquity and vendor-confirmed remote RCE, while recognizing that real-world exploitation has not yet been observed and the remote reachability mechanism is underspecified.

A remote, unauthenticated attacker sends crafted data that reaches the Windows Volume Manager Extension Driver and triggers a heap-based buffer overflow (CWE-122), corrupting kernel heap memory to achieve arbitrary code execution. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and SSVC marks the issue automatable with total technical impact, a working exploit could be scripted for broad reuse. No public exploit code has been identified at time of analysis, so this scenario is based on the vector and vulnerability class rather than an observed exploit.