Executive brief
Windows VOLSNAP.SYS is a core system driver responsible for managing volume snapshots used in system backups and recovery. A heap buffer overflow in this driver allows an authorized local user to execute arbitrary code with elevated system privileges, potentially compromising the entire system.
Technical details
A heap-based buffer overflow vulnerability exists in the Windows VOLSNAP.SYS driver, allowing privilege escalation from a user-mode context. The vulnerability requires an authenticated user with local access to trigger the overflow through a malformed input or API call to the driver. An attacker can exploit this to achieve arbitrary code execution in kernel mode, leading to complete system compromise. The vulnerability is classified as high severity with a CVSS score of 7.8; patches are expected from Microsoft.
Affected products
- Microsoft Windows VOLSNAP.SYS
Timeline
- 2026-09-08: disclosed