CVE-2026-57091

What it actually does

This is a local privilege-escalation vulnerability caused by a stack-based buffer overflow in the Windows File History Service. A low-privileged authenticated user can trigger unsafe memory handling in the service and potentially overwrite stack memory to execute code in the security context of the service. Because the vulnerable component runs as a Windows service, successful exploitation can allow elevation from a standard local user context to high-privilege code execution, potentially SYSTEM-level access, with full confidentiality, integrity, and availability impact on the affected host.

Why it matters to the business

An attacker who already has local access to a vulnerable Windows workstation or server could turn limited access into full control of the system. This can enable credential theft, disabling of security tools, tampering with backups or files, lateral movement, ransomware staging, and persistence. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has a low EPSS score, so broad exploitation is not indicated at this time; however, the high CVSS impact means it should be prioritized in normal Windows patch cycles, especially on shared workstations, jump hosts, servers, VDI, and systems where low-privileged users can log on interactively.

How an attack unfolds

An attacker first obtains authenticated local access to an affected Windows system, such as through stolen user credentials, malware running as a standard user, or interactive access to a shared machine. The attacker then interacts with the Windows File History Service in a way that supplies malformed input to the vulnerable code path. Because the service mishandles the input on the stack, the attacker may be able to corrupt memory and redirect execution flow. If exploitation succeeds, attacker-controlled code runs with the elevated privileges of the service rather than the original user. The attacker can then create privileged accounts, dump credentials, disable endpoint protections, install persistence, access protected data, or use the host as a foothold for further movement. No public exploit maturity is reported in the provided data, so defenders should focus on patching and on hunting for suspicious local privilege-escalation behavior rather than a known commodity exploit signature.

How to fix it

Apply the Microsoft security update that remediates this vulnerability for the affected Windows release. Because no exact fixed build numbers were provided, organizations should update affected Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems to the latest supported cumulative security update available from Microsoft for their branch. Prioritize systems that allow interactive logon by non-administrators, shared endpoints, VDI pools, RDS/session hosts, developer workstations, jump servers, and internet-facing servers where compromise of a low-privileged account could lead to local escalation. If immediate patching is not possible, reduce exposure by limiting local logon rights, removing unnecessary standard-user access from servers, enforcing least privilege, monitoring privileged group membership changes, and ensuring endpoint protection and exploit protection features are enabled. Avoid relying solely on disabling File History unless Microsoft explicitly documents it as a mitigation, because service dependencies and exploit paths may vary by Windows version.

How to confirm the fix worked

Confirm remediation by verifying that affected systems have installed the relevant Microsoft cumulative security update released for this vulnerability or a later cumulative update. Use enterprise patch-management inventory, Windows Update history, Microsoft Defender Vulnerability Management, WSUS, Intune, Configuration Manager, or PowerShell-based build and hotfix checks to confirm update compliance across all affected Windows versions. Validate that unsupported or out-of-servicing Windows builds are upgraded to supported branches. Confirm exposure reduction by reviewing where non-administrative users can log on locally or through RDP, and by checking whether the File History Service exists and is running on systems where it is not needed. After patching, perform regression checks for File History functionality if the feature is used operationally, and monitor for unexpected service crashes or privilege-escalation telemetry that would suggest attempted exploitation before remediation.

Typical attack path

1. Gain authenticated low-privileged access to an affected Windows workstation or server.
2. Confirm the Windows File History Service is present and vulnerable.
3. Trigger the vulnerable File History Service code path with crafted local input or service interaction.
4. Exploit the stack-based buffer overflow to gain elevated execution in the service context.
5. Run privileged commands, create persistence, dump credentials, or disable defenses.
6. Use the elevated host access to access sensitive data, move laterally, or stage additional payloads.

How to detect it

Detection should focus on evidence of attempted local privilege escalation and post-exploitation behavior rather than a fixed network signature. Review Windows Security logs for unusual successful local logons followed by privileged activity, especially Event ID 4624, 4672, 4688, 4720, 4728, 4732, 7045, and other account or service changes. Review System logs for File History Service instability, including Service Control Manager events showing unexpected termination or restart of the File History Service. Review Application logs and Windows Error Reporting for crashes involving svchost.exe with fhsvc.dll or the File History Service near the time of suspicious user activity. If Sysmon or EDR telemetry is available, hunt for abnormal child processes spawned from svchost.exe, unsigned binaries launched shortly after a File History Service crash, new local administrator membership, credential dumping tools, LSASS access attempts, and changes to security tooling. Correlate service crashes with the same user session, host, and time window for signs that a low-privileged account obtained elevated execution. Since no public exploit maturity or named threat actor activity is provided, treat isolated service crashes as suspicious only when accompanied by privilege changes, anomalous process creation, persistence, or credential access artifacts.

• fhsvc
• File History Service
• fhsvc.dll
• C:\Windows\System32\fhsvc.dll
• svchost.exe -k LocalSystemNetworkRestricted
• Service Control Manager
• Event ID 7031
• Event ID 7036
• Event ID 7045
• Windows Error Reporting
• Application Error
• Event ID 1000
• Event ID 1001
• Event ID 4672
• Event ID 4688
• Event ID 4720
• Event ID 4728
• Event ID 4732

What your security team should do

• Patch affected Windows endpoints and servers with the latest applicable Microsoft cumulative security update, prioritizing shared systems, RDS/VDI hosts, jump boxes, and servers with interactive user access.
• Inventory affected Windows versions, including Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2016/2019/2022/2025, and identify unsupported or out-of-policy builds.
• Review local and remote logon rights and remove unnecessary low-privileged user access from servers and administrative workstations.
• Hunt for suspicious local privilege-escalation behavior, including File History Service crashes, new privileged account creation, abnormal child processes from svchost.exe, and sudden assignment of administrator privileges.
• Ensure EDR, Windows Defender Exploit Guard, attack surface reduction rules, credential theft protections, and tamper protection are enabled where supported.
• Monitor for credential access and post-exploitation activity following any suspicious service crash or privilege change on affected systems.
• Because EPSS is low and no KEV listing or known exploit maturity is reported, handle as a high-impact patching priority rather than an emergency internet-wide exploitation event unless local telemetry indicates active abuse.