EUVD-2026-43268
GHSA-rvg3-9f28-p29q
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local, low-privileged user triggers a hard-to-hit integer overflow (AV:L/PR:L/AC:H) that crosses into kernel/SYSTEM (S:C) for full C/I/A impact.
Primary rating from Vendor (CSA).
CVSS VectorVendor: CSA
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.
AnalysisAI
Local privilege escalation to SYSTEM in WinFsp (Windows File System Proxy) stems from an integer overflow (CWE-190) that a low-privileged local user can trigger to achieve system-level access on the host. The flaw crosses a privilege boundary (CVSS scope change) and is fixed in release v2.2B2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a Windows system that has WinFsp installed (bundled by or installed alongside tools such as rclone mount, sshfs-win, or similar user-space file systems), plus an existing low-privileged account (PR:L) from which the attacker can invoke WinFsp file-system operations; no user interaction is needed (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 7.8 High) describes a local-only attack requiring existing low privileges and high attack complexity, but delivering full confidentiality, integrity, and availability impact with a privilege-boundary crossing (scope changed) - i.e., escalation from an ordinary user to SYSTEM. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker who already has a low-privileged interactive or service account on a Windows host crafts input that drives a WinFsp file-system operation to overflow an integer used in a size or length calculation, corrupting kernel-adjacent memory and escalating to SYSTEM. Given AC:H, the attacker likely must satisfy specific timing or value conditions to reliably trigger the overflow; no public POC or exploit code was identified at time of analysis. |
| Remediation | Vendor-released patch: WinFsp v2.2B2 - upgrade all WinFsp installations to this release or later, obtainable from https://github.com/winfsp/winfsp/releases/tag/v2.2B2, and review the CSA advisory at https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-086. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory WinFsp deployments across the organization and identify systems running versions prior to v2.2B2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today