CVE-2026-7162

View on CVE.org
Published Jul 13, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
Successful
exploitation of the integer overflow vulnerability could allow an attacker to
achieve system-level access to the affected software.

Analysis

AI-generated

Technical impact

The vulnerability is an integer overflow within the WinFsp filesystem driver. When the integer value is corrupted, the driver can be manipulated to perform privileged operations, effectively granting an attacker system-level access to the affected software.

Affected Systems

The affected product is WinFsp. Any installed version that is not the latest release is potentially impacted. The advisory does not specify particular sub‑versions, but the recommendation is to upgrade to the most recent release.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of < 1% indicates a very low but nonzero chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the nature of WinFsp, a likely vector involves manipulating malicious filesystem operations. An attacker would need to craft input data that triggers the integer overflow in the vulnerable function.

Remediation

Vendor Solution

Users and administrators of affected product versions are advised to update to the latest version immediately.

OpenCVE Recommended Actions

  • Apply the latest WinFsp release immediately, following the vendor’s instructions.
  • If an update is not yet available or cannot be applied, enforce strict role‑based access controls to limit filesystem exposure.
  • Monitor Windows event logs for anomalous file system activity and consider isolating systems that use WinFsp on a separate network segment.

Generated by OpenCVE AI on August 3, 2026 at 03:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Integer Overflow in WinFsp Enables System-Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Enables System-Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Allows System-Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Allows System-Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Enables System‑Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Enables System‑Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Allows System‑Level Access
Type Values Removed Values Added
Title Integer Overflow in WinFsp Allows System‑Level Access
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Winfsp
Winfsp winfsp
Vendors & Products Winfsp
Winfsp winfsp
Type Values Removed Values Added
Description Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.
Weaknesses CWE-190
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}
Earlier changes (6)
Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

Sources

Status
PUBLISHED
Assigner
CSA
Published
Updated
Jul 13, 2026, 3:45 PM
Reserved
Apr 27, 2026, 3:13 AM

View source JSON

Updated
Jul 13, 2026, 3:45 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 4:16 AM
Modified
Jul 13, 2026, 8:37 PM

View source JSON

No data.

Updated
Aug 3, 2026, 4:00 AM

JSON