# CVE-2026-7162: WinFsp integer overflow privilege escalation

Source: https://junglewise.ai/threats/cve-2026-7162-winfsp-integer-overflow-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-7162 · Severity: high · CVSS 7.8 · Published 2026-07-13

WinFsp is an open-source tool used to create custom file systems for Windows. A security flaw in this software could allow a user with limited access to gain full system-level control over the computer. This could lead to unauthorized access to sensitive data or the ability to disrupt system operations.

Technologies: [WinFSP](https://junglewise.ai/threats/technologies/winfsp). Vendors: [WinFSP](https://junglewise.ai/threats/vendors/winfsp).

## Quick answers

**Is CVE-2026-7162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7162 being exploited in the wild.

**How severe is CVE-2026-7162?** High severity, with a CVSS score of 7.8, published 13 July 2026.

**Which products and versions are affected?** WinFSP 2.2.26112 and lower.

**Is there a fix for CVE-2026-7162?** A patch was published on 2026-07-02: Fix released in version 2.2B2 (v2.2.26183) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7162 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-7162?** Check whether you run WinFSP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability (CWE-190) exists in WinFsp versions 2.2.26112 and earlier. The flaw allows a local attacker with low privileges to trigger an overflow condition, potentially leading to a scope cross and full system-level access. The attack requires high complexity, likely due to specific timing or environmental conditions needed to trigger the overflow. A fix has been released in version 2.2B2 (v2.2.26183).

## Affected products

- WinFsp WinFsp 2.2.26112 and lower

## Timeline

- 2026-07-02: patched: Fix released in version 2.2B2 (v2.2.26183)
- 2026-07-13: advisory: CSA and NVD published advisory details

## References

- [https://github.com/winfsp/winfsp/releases/tag/v2.2B2](https://github.com/winfsp/winfsp/releases/tag/v2.2B2)
- [https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-086](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-086)

## Related threats

- [WinFsp null pointer dereference in kernel device control handler](https://junglewise.ai/threats/cve-2026-93689-winfsp-through-2-2-26215-contains-a-null-pointer-dereference)
- [WinFSP local privilege escalation via kernel heap overflow](https://junglewise.ai/threats/cve-2026-3006-winfsp-local-privilege-escalation-via-kernel-heap-overflow)