Executive brief
Windows Work Folders is a feature that synchronizes work files across corporate devices and cloud storage. This vulnerability allows an authenticated user with local access to exploit a memory corruption flaw and gain elevated system privileges, potentially compromising the entire device and accessing sensitive corporate data.
Technical details
A heap-based buffer overflow exists in Windows Work Folders that can be triggered by a locally authenticated attacker. The vulnerability allows memory corruption through improper input handling, enabling privilege escalation from a standard user to system-level access. Exploitation requires local access and prior authentication on the affected system. An attacker can leverage this flaw to execute code with elevated privileges and take full control of the compromised machine. Microsoft has released patches to address this issue.
Affected products
- Microsoft Windows Work Folders
Timeline
- 2026-09-08: disclosed