Skip to main content

Microsoft EUVDEUVD-2026-22374

| CVE-2026-26153 HIGH
Out-of-bounds Read (CWE-125)
2026-04-14 microsoft
7.8
CVSS 3.1 · NVD
Temporal: 6.8
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CIRCL (temporal)
6.8 MEDIUM
cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Re-analysis Queued
Apr 17, 2026 - 15:22 vuln.today
cvss_changed
Analysis Generated
Apr 14, 2026 - 19:25 vuln.today
EUVD ID Assigned
Apr 14, 2026 - 17:46 euvd
EUVD-2026-22374
Analysis Generated
Apr 14, 2026 - 17:46 vuln.today
Patch released
Apr 14, 2026 - 17:46 nvd
Patch available
CVE Published
Apr 14, 2026 - 16:57 nvd
HIGH 7.8

DescriptionCVE.org

Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Out-of-bounds read in Windows Encrypting File System (EFS) enables low-privileged local attackers to escalate to SYSTEM privileges on Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2019/2022/2025. The vulnerability (CWE-125) requires local access and low-level privileges but no user interaction, yielding complete system compromise with high impact to confidentiality, integrity, and availability (CVSS 7.8). Vendor-released patches are available

Technical ContextAI

Windows Encrypting File System (EFS) is a file-level encryption feature integrated into NTFS, enabling transparent encryption/decryption of files and folders. This vulnerability stems from an out-of-bounds read (CWE-125), a memory safety flaw where the EFS driver accesses memory beyond allocated buffer boundaries when processing certain crafted inputs. The affected code runs in kernel context, making memory corruption bugs particularly dangerous. The vulnerability impacts all modern Windows client and server versions from Windows 10 1809 (released 2018) through the latest Windows 11 26H1 preview builds and Windows Server 2025, indicating a long-standing code path issue in EFS kernel components. The CPE data confirms impact across both desktop (cpe:2.3:a:microsoft:windows_10_*, cpe:2.3:a:microsoft:windows_11_*) and server (cpe:2.3:a:microsoft:windows_server_*) SKUs, including Server Core installations which lack GUI components but retain EFS functionality.

RemediationAI

Organizations should immediately deploy Microsoft's April 2025 Patch Tuesday updates to remediate this vulnerability across all affected Windows systems. Specific patched versions include Windows 10 1809 build 10.0.17763.8644 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Patches should be obtained through Windows Update, WSUS, Microsoft Update Catalog, or enterprise patch management solutions. Prioritize patching systems in multi-user environments, terminal servers, and any Windows hosts accessible to lower-privileged accounts. No effective workaround exists short of disabling EFS entirely, which would break encrypted file access for users relying on this feature. Verify patch deployment using the fixed build numbers listed above

Share

EUVD-2026-22374 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy