CVE-2026-40380

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows Volume Manager Extension Driver, a kernel-mode component involved in storage and volume management. An attacker who already has authorized high-privilege access and physical access to an affected Windows system may be able to trigger malformed storage or volume-management input that corrupts heap memory in the driver. Successful exploitation could result in kernel-mode code execution, allowing full compromise of confidentiality, integrity, and availability on the local system. The attack is constrained by the physical attack vector and high privilege requirement, and there is currently no public exploit maturity or known CISA KEV exploitation signal.

Why it matters to the business

The practical risk is highest for shared workstations, kiosks, lab systems, branch-office devices, and servers where privileged users or technicians can physically interact with the machine or attached storage. If exploited, the attacker could gain complete control of the affected Windows device, access sensitive data, disable security controls, install persistent malware, or disrupt operations. The current EPSS score is low and stable, the issue is not listed in KEV, and ransomware use is not reported, which lowers internet-scale urgency; however, systems with weak physical security or broad local administrator access should still be remediated promptly because successful exploitation has full-system impact.

How an attack unfolds

An attacker first obtains authorized access to the target system with high privileges and physical access to the device or its storage interfaces. They then interact with the Windows volume-management stack, potentially by attaching or manipulating local storage media or triggering crafted volume-management operations that reach the vulnerable Volume Manager Extension Driver. The malformed input causes a heap-based buffer overflow in kernel memory. If the attacker can shape memory conditions reliably, they may redirect execution flow and run attacker-controlled code in kernel context. From there, they can disable security tooling, extract data, create persistence, tamper with system state, or crash the host. Because exploitation requires physical access and high privileges, likely scenarios include malicious insiders, compromised administrator accounts used at the console, rogue maintenance activity, or attackers with hands-on access to unmanaged endpoints.

How to fix it

Apply the Microsoft security update that addresses this vulnerability to all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. If exact fixed build numbers are not available in the vulnerability record, use Microsoft Update, WSUS, Windows Update for Business, Intune, or other patch-management tooling to deploy the relevant cumulative update released for this issue or any later cumulative update. Prioritize devices with shared physical access, local administrator users, removable-storage exposure, or sensitive workloads. As mitigations until patching is complete, restrict physical access, minimize local administrator membership, enforce BitLocker with TPM and pre-boot protections where appropriate, enable Secure Boot, control removable storage through device-control policy, and monitor or block unauthorized storage-device installation.

How to confirm the fix worked

Confirm that affected Windows assets have installed the applicable Microsoft cumulative security update or a later superseding update. Validate through centralized patch-compliance reporting, Windows Update history, installed hotfix inventory, OS build numbers, and vulnerability scanner results. For high-assurance validation, confirm that the Volume Manager Extension Driver binary on patched systems is dated and versioned consistently with the updated Microsoft release baseline for that OS build. Re-scan after patch deployment and verify that the CVE is no longer reported. Also confirm that compensating controls are in place where patching is delayed: restricted physical access, limited local administrator rights, removable-storage controls, Secure Boot, and BitLocker policy enforcement.

Typical attack path

1. Gain physical access to an affected Windows workstation or server.
2. Authenticate or otherwise operate with authorized high-privilege local access.
3. Prepare or attach crafted storage media, or trigger crafted volume-management operations that reach the vulnerable driver path.
4. Cause heap memory corruption in the Volume Manager Extension Driver.
5. Achieve kernel-mode code execution or crash the system, depending on exploit reliability.
6. Use kernel-level control to disable defenses, access protected data, install persistence, or disrupt the device.

How to detect it

There are no reliable public CVE-specific indicators of compromise for this vulnerability, and exploitation may leave minimal artifacts if kernel-level code execution succeeds. Detection should focus on suspicious preconditions and aftermath: unexpected physical-console activity, privileged local logons, removable-storage insertion, new or unusual storage volumes, device-driver installation, security-tool tampering, kernel crash events, and post-exploitation behavior. Useful Windows log sources include Security logs for privileged logons and special privileges, System logs for disk, volume, driver, service-control, and bugcheck events, Microsoft-Windows-Kernel-PnP and DriverFrameworks logs for device installation, BitLocker events for unexpected protector or volume changes, EDR telemetry for driver loads and kernel tampering, and physical access-control records where available. Hunt for sequences where a privileged interactive logon is followed by new storage-device recognition, volume or partition changes, unexpected driver/service activity, endpoint-security disablement, or a crash/reboot. Because no known threat actors, KEV activity, or ransomware campaigns are currently associated with this issue, prioritize anomaly-based hunting over signature-based detection.

What your security team should do

• Patch affected Windows endpoints and servers with the applicable Microsoft cumulative update or later superseding update, prioritizing systems with shared or exposed physical access.
• Review and reduce local administrator membership, especially on workstations, kiosks, lab systems, and operational technology support devices.
• Restrict use of removable storage and unauthorized storage controllers through endpoint device-control policy.
• Ensure BitLocker, Secure Boot, and tamper protection are enabled where supported to reduce post-exploitation impact.
• Monitor for unusual local administrator logons, new device installation events, unexpected storage-volume changes, driver-loading anomalies, and unexplained system crashes.
• For systems that cannot be patched quickly, increase physical security controls and require documented approval for maintenance involving removable media or storage reconfiguration.
• Track Microsoft advisory updates for fixed build details or revised exploitability information, since the vulnerability is currently not known to be exploited and has low stable EPSS but carries high impact if successfully exploited.