CVE-2026-3006
Kernel Heap Overflow Race Condition Enables Local Privilege Escalation
Publication date: 2026-04-27
Last updated on: 2026-04-27
Assigner: CSA
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| winfsp | winfsp | to 2.1.25156 (exc) |
| winfsp | winfsp | 2.2B1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3006 is a race condition vulnerability in the Windows File System Proxy (WinFsp), an open-source system software. Exploiting this flaw can trigger a kernel heap overflow, which may allow an attacker to escalate their privileges locally and gain system-level access on the affected software.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to local privilege escalation, meaning an attacker with limited access could gain higher-level system privileges. This could allow them to execute arbitrary code with system-level permissions, potentially compromising the entire system's security and integrity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-3006 vulnerability, users and administrators are strongly advised to update WinFsp to the latest version immediately.
- Upgrade to WinFsp version 2.2B1 or later, which includes the critical security fix addressing this vulnerability.
- Verify the integrity of the update by checking the signed release artifacts and SHA256 hashes provided on the official WinFsp GitHub releases page.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-3006 affects compliance with common standards and regulations such as GDPR or HIPAA.