CVE-2026-3006

Race Condition Vulnerability

View on CVE.org
Published Apr 27, 2026 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Description
Successful exploitation of the race condition vulnerability could allow
an attacker to trigger a kernel heap overflow, potentially leading to local privilege
escalation and granting system-level access to the affected software.

Analysis

AI-generated

Technical impact

A race condition exists within WinFSP that, when successfully triggered, causes a kernel heap overflow. This flaw maps to CWE-362 and CWE-368 and can allow a local attacker to execute arbitrary code with elevated system-level privileges, effectively bypassing normal access controls.

Affected Systems

WinFSP (WinFSP) products are affected; the specific versions prior to the latest release are vulnerable, but the exact revision list was not provided in the description.

Risk and Exploitability

The vulnerability carries a CVSS score of 7, an EPSS score of less than 1%, and is not listed in the CISA KEV catalog. The attack vector is inferred to be local, requiring an attacker to gain a foothold on the machine to exploit the race condition and achieve privilege escalation. Despite the low EPSS, the high impact necessitates swift remediation.

Remediation

Vendor Solution

Users and administrators of affected product versions are advised to update to the latest version immediately.

OpenCVE Recommended Actions

  • Apply the latest WinFSP update (v2.2B1 or later) immediately to close the race condition flaw.
  • Restrict local user permissions and isolate critical resources until the patch is installed to reduce the chance of privilege escalation.
  • Monitor system logs for signs of kernel heap overflow attempts or unusual local activity and enforce strict access controls around the affected software until a definitive fix is in place.

Generated by OpenCVE AI on April 28, 2026 at 04:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Winfsp
Winfsp winfsp
Vendors & Products Winfsp
Winfsp winfsp
Type Values Removed Values Added
Weaknesses CWE-362
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-368
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to the affected software.
Title Race Condition Vulnerability
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-368

    Context Switching Race Condition

Sources

Status
PUBLISHED
Assigner
CSA
Published
Updated
Jul 15, 2026, 1:10 AM
Reserved
Feb 23, 2026, 5:15 AM

View source JSON

Updated
Apr 27, 2026, 1:19 PM

JSON

Status
Awaiting Analysis
Published
Apr 27, 2026, 3:15 AM
Modified
Jul 15, 2026, 2:20 AM

View source JSON

Severity
Important
Public date
Apr 27, 2026, 2:35 AM

View source Bugzilla JSON

Updated
Apr 28, 2026, 5:00 AM

JSON