Windows Volume Manager EUVD-2026-73685

Exploitation requires a target user to perform an interactive action that causes Windows to process volume or share data from an attacker-controlled source (UI:R per vendor CVSS vector). No prior authentication to the target system is required by the attacker (PR:N). The attack is reachable over an arbitrary network path, not limited to adjacent-segment access (AV:N/AC:L). The specific triggering interaction is not enumerated in the available description but is consistent with scenarios such as browsing a UNC path, mounting a network volume, or opening a file from a remote share via Windows Shell. Exploitation is constrained to systems where users actively interact with externally supplied storage sources; fully headless, network-isolated server deployments with no user sessions and no externally mounted volumes face lower immediate risk. Windows Server 2012 and 2012 R2 systems without an ESU subscription may remain permanently unpatched.

The CVSS 8.8 score reflects high CIA impact with network reach and no prior authentication required, tempered only by the UI:R requirement which introduces a dependency on a user-initiated interaction event. The AC:L metric confirms no complex race conditions or configuration prerequisites beyond that interaction, meaning the attack is technically straightforward once a user engages with attacker-controlled volume content-an event as routine as browsing a mapped network share in Windows Explorer. The kernel-mode context of the Volume Manager Extension Driver means successful exploitation almost certainly yields SYSTEM-level code execution, amplifying post-exploitation impact well beyond what S:U formally captures. No KEV listing or EPSS data was provided, so exploitation remains inferred rather than confirmed; however, the breadth of affected versions-spanning unsupported Server 2012 systems through current Server 2025-means even a mid-sized municipal IT team in sopot should treat this as urgent, particularly given that legacy Windows Server deployments frequently lack compensating controls. The primary limiting signal is UI:R: passive, unattended Windows endpoints that do not browse external shares face materially lower immediate risk than interactive workstations and file-server clients in mixed environments.

An attacker establishes a malicious SMB server on the network and distributes a link or UNC path (e.g., via phishing email or poisoned DNS) that directs a Windows user to browse the share in File Explorer. When the Windows Volume Manager Extension Driver processes the crafted volume descriptor returned by the malicious server, the heap buffer overflow is triggered in kernel context, allowing the attacker to overwrite kernel heap structures and achieve arbitrary code execution at SYSTEM privilege. No public exploit code has been identified at time of analysis, but the AC:L rating indicates the attack primitive is not complex once user interaction is obtained.