EUVD-2026-73343
GHSA-w69f-g69f-235j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege local access
-
DeliveryInvoke File History Service operation
-
ExploitTrigger CWE-191 integer underflow
-
ExecutionCorrupt memory / hijack execution
-
ImpactElevate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires the attacker to already possess a local, low-privileged account on the affected Windows host (AV:L, PR:L) and to interact with the Windows File History Service - the backup/versioning component present by default on Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019. No user interaction is needed (UI:N), but high attack complexity (AC:H) limits reliability, implying the integer underflow must be triggered under specific timing or state conditions rather than deterministically. Not remotely exploitable and not usable without prior local code execution, which are the primary limiting factors. |
| Impact | This is a moderate-priority local elevation-of-privilege issue, not an urgent internet-facing threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) requires local access, low privileges already held, and - critically - high attack complexity (AC:H), which signals that reliably winning the integer-underflow condition (likely a race or precise state manipulation in the File History Service) is non-trivial. All confirming signals agree it is low-urgency: EPSS is only 0.26% (18th percentile), there is no CISA KEV listing, no public exploit code is referenced, and CISA's SSVC scores Exploitation as 'none' and Automatable as 'no'. The one aggravating signal is SSVC Technical Impact 'total,' which is consistent with the C:H/I:H/A:H claim of full SYSTEM-level compromise once exploited. Signals are internally consistent - high potential impact but low real-world exploitation likelihood and meaningful complexity barrier - so this belongs in routine Patch Tuesday remediation cycles rather than emergency out-of-band response. No conflicting data was observed; the vector's local scope matches the description's 'elevate privileges locally.' |
| Exploit ScenarioDerived | A local attacker who already has an unprivileged foothold on a Windows endpoint (e.g., via phishing or a low-privilege service account) runs a crafted tool that drives the File History Service into an integer underflow condition, corrupting memory to execute code as SYSTEM. Because attack complexity is high (AC:H), the exploit likely depends on winning a race or achieving a precise state, so success may require multiple attempts. No public proof-of-concept exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 21, 2026
Local privilege escalation in the Windows File History Service lets an attacker who already holds a low-privileged account on an affected Windows host escalate to SYSTEM by triggering an integer underflow (CWE-191) while the service processes backup/versioning operations. Affected platforms are Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations. Exploitation is local only and requires pre-existing code execution on the host (AV:L, PR:L) with high attack complexity (AC:H), no user interaction (UI:N), and full confidentiality, integrity, and availability impact on the compromised machine; no public exploit code has been identified at time of analysis, EPSS is low at 0.26% (18th percentile), CISA SSVC records exploitation as "none" and automatable as "no", and there is no KEV listing. Vendor-released patches are available, so this is a moderate-priority local elevation-of-privilege issue rather than an urgent internet-facing threat.
Earlier versions of this analysis (1)
Local privilege escalation in the Windows File History Service exploits an integer underflow (CWE-191) that allows an already-privileged local attacker to gain full system-level access on affected Windows 10, 11, and Server 2016/2019 builds. The CVSS vector (AV:L/AC:H/PR:H) reflects that exploitation requires both high local privileges and complex conditions, significantly tempering real-world threat despite the complete C/I/A impact values. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patches covering all affected build families.
RemediationAI
Vendor-released patch: install the current cumulative update so each platform reaches at least its fixed build - Windows 10 1607 / Windows Server 2016 at 10.0.14393.9512, Windows 10 1809 / Windows Server 2019 at 10.0.17763.9245, Windows 10 21H2 at 10.0.19044.7725, Windows 10 22H2 at 10.0.19045.7725, Windows 11 23H2 at 10.0.22631.7582, Windows 11 24H2 at 10.0.26100.9445, Windows 11 25H2 at 10.0.26200.9445, and Windows 11 26H1 at 10.0.28000.2954; see the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72947 for the authoritative package list. Because this is a local-only, post-compromise escalation flaw, patching is the definitive fix and ordinarily the entire remediation - there is no network attack surface to firewall. Where immediate patching is not possible, the practical compensating control is to stop and disable the File History Service (fhsvc) and its related tasks on hosts that do not use File History, which removes the vulnerable processing path but permanently eliminates automatic versioned file backups for that endpoint (revert only after patching). Note that on hosts where File History is actively used the service cannot simply be disabled without losing that protection, so those systems should be prioritized for the cumulative update instead. Reducing the population of low-privileged local accounts, restricting interactive logon and RDP rights, and monitoring for unusual elevation activity around fhsvc.exe provide only marginal risk reduction given that the attacker must already hold a local account; they do not substitute for the vendor patch. No public exploit code or proof-of-concept has been identified, EPSS is 0.26%, and CISA SSVC records exploitation as "none", so emergency out-of-band handling is not indicated, but standard monthly patch cadence should be met.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 12 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an integer underflow (wrap or wraparound), classified as CWE-191, inside the Windows File History Service (fhsvc), the built-in component that periodically snapshots user files to a local or network backup target. Integer underflow occurs when a subtraction on an unsigned or size-related value falls below its minimum representable value and wraps to an extremely large number; that wrapped value is then typically used as a length, index, or buffer size, producing out-of-bounds memory access in the context of the privileged service. Because File History performs file enumeration, hashing, and catalog/version-store bookkeeping, an attacker able to influence the inputs or state consumed by those calculations can drive the wrap condition and convert the resulting memory corruption into code executing at the service's elevated privilege level, yielding full read/write/execute control (C:H/I:H/A:H, scope unchanged). The assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H shows the attack surface is strictly local: the attacker must already run code as a low-privileged user (PR:L, AV:L) on the box, and the high complexity rating (AC:H) reflects that the underflow is only reachable under specific timing, catalog, or version-store state conditions rather than deterministically on every attempt. No network exposure, no remote-vector path, and no authentication bypass are involved; the sole value of the flaw to an adversary is the privilege boundary crossing from a normal user context to SYSTEM/administrator within an already-compromised host.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local EoP requiring an existing low-priv account (AV:L/PR:L); the underflow needs a precise/racy trigger (AC:H); successful exploitation yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege-escalation vulnerability in the Windows File History Service (CVE-2026-72947) affects Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019, including Server Core installations, and would let an attacker who already holds a low-privileged account on a host escalate to full SYSTEM control. Exploitation is authenticated and local only, requires pre-existing code execution, high attack complexity, and no public exploit identified at time of analysis, so this is a depth-of-intrusion risk rather than a broad external threat. Leadership should care because any successful abuse turns a contained foothold into complete endpoint compromise, exposing credentials, data, and configuration on the affected system. Vendor-released patches exist, making this a manageable remediation-backlog item rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB