Windows EFS EUVD-2026-56309

Exploitation requires a valid local Windows user account with at least standard (low) privileges - confirmed by the CVSS PR:L metric. The attacker must have local logon access to the target system, either interactively or via Remote Desktop. The Windows Encrypting File System must be accessible on the target; systems where EFS has been explicitly disabled via Group Policy are not exploitable. No special configuration beyond a standard Windows installation with EFS functional is required. Exploitation is further limited by the local attack vector (AV:L): remote unauthenticated exploitation is not possible. Guest-tier accounts or anonymous network access cannot trigger the vulnerability. The impact is confined to information disclosure with no integrity or availability consequence, and scope is unchanged (the vulnerability does not break out of the exploiting process's security context).

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects a constrained but meaningful risk profile: the attack vector is strictly local (AV:L), complexity is low (AC:L), and only standard user privileges are required (PR:L), meaning no authentication escalation is needed beyond a normal Windows logon. The high confidentiality impact (C:H) is the primary driver of concern - EFS stores encryption keys and could leak cryptographic material or plaintext file content through the out-of-bounds read. No EPSS score was provided in the intelligence data, and the absence of a KEV entry and any reported POC code suggests this has not been actively weaponized at scale. That said, the scope of affected Windows versions is unusually broad - from Windows Server 2012 to the latest Windows 11 and Server 2025 builds - meaning even a mid-sized municipal IT team in tczew running a heterogeneous Windows estate should treat this as an urgent patching priority, particularly on file servers where EFS-protected data is present. CVSS signals are internally consistent and align with the description; no conflicting data was identified.

A standard Windows user account - obtained via phishing, insider access, or credential reuse - logs on locally or via Remote Desktop to a Windows system where EFS-encrypted files are present. The attacker invokes EFS APIs or crafts a file system interaction that causes the EFS kernel driver to process a malformed or boundary-triggering EFS metadata structure, triggering the out-of-bounds read. Memory adjacent to the read buffer - potentially containing EFS encryption key blobs or plaintext file content fragments - is returned to the attacker, enabling disclosure of data that EFS was meant to protect. No public exploit code has been identified at time of analysis.