Windows Volume Manager EUVD-2026-72975

The attacker must have an existing authenticated local session on the target Windows system with at least a standard (low-privileged) user account - this is confirmed by the CVSS PR:L metric. No additional software needs to be installed by the victim (UI:N) and no non-default configuration is required; the Volume Manager Driver is a core Windows kernel component loaded on all standard installations. Exploitation is limited to local access (AV:L): remote attackers without an existing foothold cannot trigger this directly. The attack complexity is rated low (AC:L), meaning no race conditions or special timing requirements are needed. The vulnerability does not require elevated privileges to trigger - a guest or standard domain account is sufficient as the initial condition.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes a well-understood local privilege escalation class: any low-privileged account on an affected system can exploit this deterministically, with no user interaction and low complexity. The Scope:Unchanged rating means the exploit targets the kernel within the same security boundary, yet the C:H/I:H/A:H ratings reflect that kernel-level compromise equals full system control. No KEV listing is present and no public proof-of-concept has been identified at time of analysis, keeping real-world immediacy lower than an actively exploited vulnerability. However, local privilege escalation flaws in Windows kernel drivers are historically a favored post-exploitation step in ransomware and APT operations - once an attacker has any foothold (phishing, RCE in a web-facing service), this type of flaw converts a low-privileged shell into SYSTEM. The breadth of affected versions - spanning Windows Server 2012 through Windows Server 2025 and all current Windows 10/11 branches - means even a mid-sized municipal IT team in walbrzych should treat this as urgent patching, since unpatched endpoints represent a trivial escalation path for any attacker who achieves initial access. EPSS data is not provided in the source intelligence; risk prioritization should default to patch-urgency based on version exposure and endpoint count.

An attacker who has compromised a domain user account - via phishing or credential theft - logs into a Windows workstation or server and executes a crafted program that calls Volume Manager Driver IOCTLs with a malformed input buffer. The oversized write overflows the kernel heap, corrupting adjacent structures to redirect execution to attacker-controlled shellcode running as SYSTEM. No public proof-of-concept has been identified at time of analysis, but the low complexity rating suggests the exploit primitive is straightforward once the overflow offset is characterized.