Windows Volume Manager EUVD-2026-73008

Exploitation requires an authenticated low-privileged local user account on the target Windows system - the attacker must already have the ability to execute code locally (PR:L per CVSS). The Windows Volume Manager Extension Driver is loaded by default across all affected Windows versions; no non-default feature enablement or special configuration is required. Exploitation is not achievable remotely without a separate initial-access vector that first delivers local code execution. No user interaction beyond the attacker's own crafted request is required (UI:N), and attack complexity is low (AC:L), meaning no race condition, heap spray tuning, or information leak pre-stage is specified in the available data. What limits exploitation: the requirement for pre-existing local authenticated access is the primary barrier; network-only attackers cannot directly trigger this vulnerability.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes this as a locally-exploitable privilege escalation: the attacker must already hold a low-privileged authenticated session on the target machine, which constrains direct remote exploitation. However, Windows kernel driver LPE vulnerabilities of this class are a primary second-stage payload in post-compromise attack chains - phishing or initial-access brokers commonly deliver such exploits after gaining a foothold. The attack complexity is low and no user interaction is required once local access is secured, making this trivially weaponizable given working exploit code. EPSS data is absent from the provided intelligence and cannot be assessed; however, the sheer breadth of affected Windows versions - from Server 2012 through the latest Server 2025 and Windows 11 26H1 - means the theoretical exposure pool is enormous across enterprise, government, and SMB environments. No CISA KEV listing or confirmed public exploit code exists, which moderates the urgency slightly, though patch-diff analysis by researchers commonly produces working LPE exploits within weeks of a Patch Tuesday release; even a mid-sized municipal IT team in boleslawiec should treat this as urgent given the low post-patch exploitation window for kernel driver LPE bugs. End-of-life Windows Server 2012 and 2012 R2 systems receiving patches under ESU agreements represent a particular risk for organizations slow to migrate.

An attacker who has obtained a low-privileged local user account - via phishing, credential theft, or lateral movement - submits a crafted I/O control request to the Windows Volume Manager Extension Driver, triggering the buffer over-read in kernel mode. Exploiting the resulting out-of-bounds memory condition, the attacker corrupts an adjacent kernel token structure to elevate the process to SYSTEM, enabling full machine takeover. No public exploit code has been confirmed; this scenario reflects the standard exploitation class for kernel driver LPE bugs discovered and patched through Microsoft's coordinated disclosure process.