Windows Volume Manager Driver EUVD-2026-72964

Exploitation requires the attacker to hold a valid low-privileged account (PR:L) on the target Windows system or domain, ruling out fully unauthenticated remote attacks. The CVSS UI:R metric confirms that successful exploitation also requires some form of user interaction - likely a legitimate user initiating or approving a volume-related storage operation that the attacker can influence or time their request against. The network attack vector (AV:N) means the attacker does not need local or adjacent-network access; any routable network path to a Windows host with exposed storage services suffices. Exploitation is limited by: (1) the requirement for a pre-existing authenticated account, preventing purely anonymous attacks; (2) user interaction as a necessary trigger, complicating fully automated exploitation; (3) network exposure of storage protocols - environments that firewall SMB/iSCSI at the perimeter have reduced exposure. Default Windows installations with SMB enabled on domain networks satisfy the attack conditions without additional configuration changes.

CVSS 8.0 with AV:N/AC:L/PR:L/UI:R accurately captures a meaningful but not trivially weaponizable threat: exploitation requires an existing low-privileged account and some form of user interaction, which limits fully automated mass exploitation. EPSS data is not provided in the input, but given the breadth of affected platforms and the Microsoft provenance (reported via secure@microsoft.com), real-world risk is elevated. No public exploit code exists at time of analysis and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation. That said, even a mid-sized municipal IT team in gdynia should treat this as urgent, because the sheer surface area - covering virtually every supported and recently end-of-life'd Windows version - means unpatched hosts across diverse environments are exposed. The UI:R requirement is the primary friction point distinguishing this from a fully remotely exploitable critical; defenders should focus on patch deployment rather than rely on UI:R as a durable mitigating factor. SSVC assessment: exploitation status Not-Detected, automatable No (UI:R), technical impact Total - priority is Attend to High.

An attacker with a low-privileged domain or local account on a Windows network crafts a malicious storage operation request - for example, via an SMB-accessible share or network volume - targeting the Volume Manager Driver. The request triggers a heap overflow in the kernel driver, and with the victim user initiating or approving a storage operation (satisfying UI:R), the attacker overwrites kernel structures to redirect execution and gain SYSTEM-level privileges. No public proof-of-concept code has been identified at time of analysis.