Is CVE-2026-7162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7162 being exploited in the wild.

How severe is CVE-2026-7162?

High severity, with a CVSS score of 7.8, published 13 July 2026.

Is there a fix for CVE-2026-7162?

A patch was published on 2026-07-02: Fix released in version 2.2B2 (v2.2.26183) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-7162 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-7162?

Check whether you run WinFSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7162: WinFsp integer overflow privilege escalation

CVE-2026-7162 · Severity: high · CVSS 7.8 · Published 2026-07-13

WinFsp is an open-source tool used to create custom file systems for Windows. A security flaw in this software could allow a user with limited access to gain full system-level control over the computer. This could lead to unauthorized access to sensitive data or the ability to disrupt system operations.

Technologies: WinFSP. Vendors: WinFSP.

Quick answers

Is CVE-2026-7162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7162 being exploited in the wild.
How severe is CVE-2026-7162?: High severity, with a CVSS score of 7.8, published 13 July 2026.
Which products and versions are affected?: WinFSP 2.2.26112 and lower.
Is there a fix for CVE-2026-7162?: A patch was published on 2026-07-02: Fix released in version 2.2B2 (v2.2.26183) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-7162 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-7162?: Check whether you run WinFSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability (CWE-190) exists in WinFsp versions 2.2.26112 and earlier. The flaw allows a local attacker with low privileges to trigger an overflow condition, potentially leading to a scope cross and full system-level access. The attack requires high complexity, likely due to specific timing or environmental conditions needed to trigger the overflow. A fix has been released in version 2.2B2 (v2.2.26183).

Affected products

WinFsp WinFsp 2.2.26112 and lower

Timeline

2026-07-02: patched: Fix released in version 2.2B2 (v2.2.26183)
2026-07-13: advisory: CSA and NVD published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.