Microsoft Windows: Out-of-bounds read in Windows Volume Manager Extension Driver

Summary

A local out-of-bounds read in the Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges on the affected system. The attacker needs a valid low-privilege user account on the machine, so the flaw is not reachable remotely. Microsoft rates it as High (CVSS 3.1 7.8), and CISA's SSVC data records no known exploitation.

Affected

• Windows 10 Version 1607 (below 10.0.14393.9612)
• Windows Server 2016 (below 10.0.14393.9612)
• Windows 10 Version 1809 (below 10.0.17763.9376)
• Windows 10 Version 21H2 and 22H2 (below 10.0.19045.7807)
• Windows 11 Versions 23H2, 24H2, 25H2, 26H1 and 26H2 (see the CNA record for exact builds)
• Windows Server 2012 and 2012 R2 (below 6.2.9200.26434 and 6.3.9600.23470)

Fixed in

• Windows 10 1607 and Windows Server 2016: build 10.0.14393.9612 or later (aggregator data, verify on MSRC)
• Windows 10 1809: build 10.0.17763.9376 or later
• Windows 10 21H2 and 22H2: build 10.0.19045.7807 or later
• Windows 11 24H2 and 25H2: the fixed build is disputed between sources (10.0.26100.9711 versus 10.0.26100.33650); verify on MSRC
• Cumulative update KB numbers for Windows 10 1607 and Server 2016: Unknown.

Workaround

Unknown. Microsoft has not published a workaround in the sources reviewed. Disabling or uninstalling the driver is not practical for a core storage component and should only be considered after testing.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV. EPSS score under 1%.
• No public proof of concept or in-the-wild exploitation found in the research, which is not proof that none exists.

Our recommendation

• Install the latest October 2026 cumulative security update on all supported Windows and Windows Server systems, after checking the fixed builds on the MSRC advisory.
• Treat Windows 10 1607 and Windows Server 2016 systems as high priority; verify their support status on Microsoft's lifecycle page, and upgrade or isolate them if no fix is available.
• Restrict local logon, enforce least privilege, and monitor for suspicious kernel-level or privilege-escalation activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85356 msrc.microsoft.com
• NVD mirror (Vulners): CVE-2026-85356 vulners.com
• OpenCVE: CVE-2026-85356 app.opencve.io
• Strix: CVE-2026-85356 www.strix.ai
• Microsoft partner list 2026 CVEs (PDF) cdn-dynmedia-1.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:16.