Executive brief
Microsoft Windows Volume Manager Extension Driver contains a buffer over-read vulnerability that allows an authorized local attacker to elevate their privileges on an affected system. This driver is a core Windows component responsible for managing disk volumes and storage. Exploitation could allow an attacker with limited account access to gain administrative control over the computer, potentially leading to complete system compromise, data theft, or malware installation.
Technical details
A buffer over-read vulnerability exists in the Windows Volume Manager Extension Driver, a kernel-mode driver handling disk volume management operations. The vulnerability allows an authorized local attacker to read memory beyond intended boundaries, potentially disclosing sensitive kernel data or craft an exploit to escalate privileges to SYSTEM level. Attack preconditions require valid local user credentials and ability to execute code locally. The buffer over-read can be triggered through specific I/O control requests to the driver. Microsoft has issued a security patch to address this vulnerability; systems should apply the latest Windows updates to remediate the issue.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed