Quick answers
- Is CVE-2026-3006 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3006 being exploited in the wild.
- How severe is CVE-2026-3006?
- High severity, with a CVSS score of 7, published 27 April 2026.
- Which products and versions are affected?
- WinFSP 2.1.25156 and lower.
- Is there a fix for CVE-2026-3006?
- A patch was published on 2026-04-22: WinFSP 2026 Beta1 (v2.2B1) released with fix. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-3006 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-3006?
- Check whether you run WinFSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A race condition vulnerability (CWE-362/CWE-368) exists in WinFSP versions 2.1.25156 and earlier. The flaw occurs during concurrent execution or context switching, which can be exploited to trigger a kernel heap overflow. An attacker with local access and low privileges can leverage this to achieve local privilege escalation (LPE) and gain system-level permissions. The attack complexity is rated as high due to the timing requirements of the race condition. The issue is addressed in WinFSP version 2.2B1. Red Hat has also identified potential transitive impacts in products like Advanced Cluster Management for Kubernetes.
Affected products
- WinFSP WinFSP 2.1.25156 and lower
- Red Hat Advanced Cluster Management for Kubernetes 2 2
Timeline
- 2026-04-22: patched: WinFSP 2026 Beta1 (v2.2B1) released with fix.
- 2026-04-27: disclosed: Initial disclosure by CSA and Red Hat.
- 2026-04-27: advisory: NVD record published.