Windows Server 2019 EUVD-2026-22374

Attacker must have valid local user account on Windows system with EFS feature enabled. Target machine must process specially crafted EFS-encrypted files triggering the out-of-bounds read vulnerability in Windows EFS driver.

This represents a significant privilege escalation risk in enterprise environments where attackers have already achieved initial low-privilege access through phishing, supply chain compromise, or other vectors. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local attack vector requiring low privileges with low complexity and no user interaction-characteristics that make exploitation reliable once an attacker has foothold access. The unchanged scope (S:U) means exploitation occurs within the vulnerable component's security context, but with complete CIA impact (C:H/I:H/A:H), granting SYSTEM-level control. While no public exploit code or CISA KEV listing exists at time of analysis, the combination of widespread deployment (14 distinct Windows versions affected per EUVD data), low attack complexity, and availability of vendor patches signals this will likely appear in penetration testing frameworks. The buffer overflow tag alongside out-of-bounds read classification suggests potential for controlled memory corruption beyond information disclosure. Organizations running unpatched Windows systems in multi-user environments or accepting untrusted local code face elevated risk, particularly in scenarios where lateral movement from low-privilege service accounts to SYSTEM is a critical control boundary.

An authenticated local user creates a malformed EFS-encrypted file. When the Windows EFS driver processes this file, the out-of-bounds read exposes kernel memory, allowing privilege escalation to SYSTEM level without user interaction.