EUVD-2026-99503
GHSA-h6gw-ccff-7jf9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryCraft malicious EFS request
-
ExploitTrigger heap buffer overflow in EFS
-
ExecutionGroom heap to control corruption
-
ImpactExecute code / elevate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold valid low-privileged authenticated access to the target Windows system (PR:L) and local code-execution capability (AV:L) - there is no remote or network-facing path. The vulnerable component is the Encrypting File System (EFS), present by default in supported Windows client and server editions, so no non-default feature toggle is implied by the description. The principal limiting factor is high attack complexity (AC:H): reliably triggering and weaponizing the heap-based buffer overflow requires defeating heap/allocator state (grooming or race conditions), which constrains dependable exploitation. No user interaction is required (UI:N). |
| Impact | This is a genuine but second-tier priority - a serious flaw that is unlikely to see mass exploitation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) is internally consistent with the description: local attack vector matches 'elevate privileges locally', PR:L matches 'authorized attacker' (a user who already has a foothold), and full C/I/H/A impact matches a successful privilege escalation to SYSTEM. The key risk-dampening signal is AC:H - exploiting a heap overflow in EFS reliably typically requires defeating heap mitigations or winning a race/grooming the allocator, which lowers real-world weaponization likelihood. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - this is a post-authentication local EoP, not a remotely wormable bug. SSVC framing: exploitation status = none observed, automatable = no (local access plus high complexity), technical impact = total. Net: patch on a normal prioritized cadence for a privilege-escalation bug, ahead of low-impact issues but behind any network-reachable or actively-exploited item. |
| Exploit ScenarioDerived | An attacker who already has low-privileged authenticated access to a Windows host (e.g., via phishing, stolen credentials, or an initial-access exploit) runs a crafted program that triggers the heap-based buffer overflow in the Encrypting File System (EFS) component. By carefully grooming the kernel/EFS heap to control the overflow, they corrupt adjacent structures to execute code or escalate to SYSTEM. No public POC is referenced in the input, and the high attack complexity (AC:H) means reliable exploitation requires non-trivial heap manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Microsoft Windows Encrypting File System (EFS) allows an authenticated attacker who already has low-privileged code execution on a host to trigger a heap-based buffer overflow and escalate to full system rights. The flaw (CWE-122) carries a 7.0 CVSS score with high attack complexity, because dependable exploitation requires defeating heap allocator state rather than a simple one-shot trigger; the vector AV:L/PR:L/UI:N confirms there is no remote or network-facing path and authentication at a low privilege level is required. Microsoft has released vendor patches, and no public exploit identified at time of analysis - this is a genuine but second-tier priority: a serious flaw that is unlikely to see mass exploitation.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85791, bringing each SKU at or above the fixed build thresholds identified in the affected-version data - for example 10.0.19044.7807 (Windows 10 21H2/22H2), 10.0.14393.9612 (Windows 10 1607 and Server 2016), 10.0.17763.9376 (Windows 10 1809 and Server 2019), 10.0.20348.5761 (Server 2022), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2), 10.0.26100.33650 (Server 2025), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 6.2.9200.26434 (Server 2012) and 6.3.9600.23470 (Server 2012 R2), and install the latest cumulative update for any SKU already past those baselines. Because this is a kernel-resident component, the update requires a reboot; schedule the maintenance window accordingly, and prioritize multi-user, RDP-exposed and shared-workstation hosts where low-privileged local accounts and untrusted code execution are common. Where patching cannot be immediate, the most effective compensating control is to shrink the local code-execution surface that AV:L/PR:L requires - enforce WDAC or AppLocker to block untrusted binaries and scripts (trade-off: may block legitimate unsigned or line-of-business software and requires careful allowlisting to avoid operational breakage), and reduce the number of accounts permitted local interactive logon or local administrator rights. EFS itself can be deactivated to remove the attack path: set the Group Policy or registry value NtfsDisableEncryption=1 under HKLM\SYSTEM\CurrentControlSet\Control\FileSystem to prevent new EFS operations, or stop and disable the Encrypting File System (EFS) service (trade-off: users lose the ability to encrypt files and certificate-based key management stops working, and note that neither setting removes the vulnerable kernel code or decrypts existing ciphertext, so already-encrypted data may become inaccessible or require re-enabling the service to read). Monitoring for abnormal EFS API activity (EncryptFile, OpenEncryptedFileRaw) and for unexpected elevation to SYSTEM should be used to detect exploitation attempts in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Encrypting File System (EFS) is the native NTFS-based file encryption feature in Microsoft Windows, implemented predominantly in kernel-mode components (efs.sys / efscore.sys) with supporting user-mode functionality in the EFS service and Win32 APIs such as EncryptFile, DecryptFile and OpenEncryptedFileRaw; it manages per-file File Encryption Keys protected by user certificates and Data Recovery Agent keys. The root cause is a heap-based buffer overflow (CWE-122): the vulnerable routine mishandles buffer sizing or bounds when processing attacker-influenced data, so a write overruns the allocated heap block and corrupts adjacent heap metadata or objects. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H and the independent assessment make clear that exploitation requires existing local, low-privileged authenticated access and local code-execution capability, and that the limiting factor is high attack complexity - the attacker must groom or race the heap to place useful data around the corrupted block and convert memory corruption into controlled execution in a SYSTEM context (integrity and availability impacts are both High, with no scope change). The affected component ships by default in supported Windows client and server editions, so no non-default feature toggle is implied.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only privilege escalation by an already-authenticated user gives AV:L and PR:L; heap grooming for a reliable overflow justifies AC:H; successful EoP yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege escalation flaw in Microsoft Windows Encrypting File System (EFS) means an attacker who already has a foothold on a Windows host could elevate to system-level control, putting encrypted data and downstream systems at risk. Exploitation requires authenticated local access with low privileges and is technically complex, and at this time no public exploit identified at time of analysis, so this is a serious but second-tier patching priority. Leadership should care because successful exploitation could enable unauthorized access to encrypted files, credential theft, and lateral movement from affected endpoints or servers.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB