CVE-2026-26176: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-26176 Overview

CVE-2026-26176 is a heap-based buffer overflow [CWE-122] in the Windows Client Side Caching driver (csc.sys). The flaw allows an authenticated local attacker to corrupt kernel heap memory and elevate privileges to SYSTEM. Microsoft addressed the vulnerability across supported Windows desktop and server releases.

The vulnerability impacts client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. Exploitation requires local access and low privileges, with no user interaction needed. A successful attack compromises confidentiality, integrity, and availability of the affected host.

Critical Impact
Successful exploitation grants kernel-mode code execution from a low-privileged local account, enabling full system takeover and persistence.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 architectures
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and Windows Server 2025

Discovery Timeline

2026-04-14 - CVE-2026-26176 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-26176

Vulnerability Analysis

The Client Side Caching driver (csc.sys) implements offline file caching for Windows clients that access SMB shares. The driver exposes I/O control interfaces that user-mode processes can invoke through DeviceIoControl calls. A heap-based buffer overflow in one of these handlers allows an attacker to write beyond an allocated kernel pool buffer.

Because csc.sys runs in kernel mode, overflowing a pool allocation enables corruption of adjacent objects or pool metadata. Attackers can leverage this primitive to overwrite function pointers or process tokens and achieve arbitrary kernel-mode execution. The result is elevation from a standard user context to SYSTEM.

Root Cause

The root cause is improper validation of attacker-controlled length or offset values used to size or index a heap allocation inside csc.sys. When a caller submits a crafted request, the driver copies data past the end of the destination pool buffer. This pattern matches CWE-122, heap-based buffer overflow, and is consistent with prior pool corruption issues in Windows file system filter drivers.

Attack Vector

Exploitation is local and requires authenticated access to the target host. An attacker running code as a standard user opens a handle to the CSC device object and issues a crafted IOCTL that triggers the overflow. No user interaction is required, and the attack does not cross a network boundary.

The vulnerability is most relevant on multi-user systems, terminal servers, virtual desktop infrastructure, and any environment where untrusted code can execute under low-privileged accounts. Refer to the Microsoft Security Update Guide for technical specifics released by the vendor.

Detection Methods for CVE-2026-26176

Indicators of Compromise

Unexpected csc.sys driver crashes or bugchecks (notably BAD_POOL_HEADER, KERNEL_MODE_HEAP_CORRUPTION, or DRIVER_VERIFIER_DETECTED_VIOLATION) on hosts where offline files are not actively used
New SYSTEM-context processes spawned from a parent that runs as a standard user shortly after CSC device handle activity
Anomalous DeviceIoControl requests targeting the \Device\Csc or \\.\Csc device object from unsigned or recently dropped binaries

Detection Strategies

Enable Driver Verifier with special pool on csc.sys in non-production fleets to surface heap corruption attempts during exploit testing
Hunt for token swap behavior, where a process token shifts from a low-integrity user SID to SYSTEM without a legitimate parent transition such as services.exe
Correlate kernel crash telemetry referencing csc.sys with prior process execution from user-writable paths (%TEMP%, %APPDATA%, Downloads)

Monitoring Recommendations

Forward Windows kernel crash, WER, and Sysmon process-create events to a centralized analytics platform for correlation across endpoints
Behavioral identification engines such as those in Singularity Endpoint can flag privilege escalation patterns including token theft and unexpected SYSTEM-context children of unprivileged processes
Track installation status of the April 2026 cumulative updates across the fleet to identify unpatched hosts still exposed to CVE-2026-26176

How to Mitigate CVE-2026-26176

Immediate Actions Required

Deploy the April 2026 Microsoft security updates referenced in the Microsoft advisory for CVE-2026-26176 to all affected Windows client and server builds
Prioritize patching on multi-user systems, jump hosts, Remote Desktop Session Hosts, and VDI images where low-privileged users execute code
Audit accounts with interactive logon rights and remove unnecessary local logon permissions on sensitive servers

Patch Information

Microsoft published fixes through the Security Update Guide on April 14, 2026. Updates are available for Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. Administrators should validate that the corresponding KB for each build is installed and that csc.sys reflects the patched file version after reboot.

Workarounds

Disable the Offline Files feature through Group Policy (Computer Configuration > Administrative Templates > Network > Offline Files > Allow or Disallow use of the Offline Files feature) on hosts that do not require client-side caching
Stop and disable the CscService and confirm that csc.sys is no longer loaded where Offline Files is not in use
Restrict local logon and remote interactive access on servers to reduce the population of users able to invoke the vulnerable IOCTL path

bash

# Disable the Offline Files service as a temporary workaround
sc.exe config CscService start= disabled
sc.exe stop CscService

# Verify driver version after patch deployment
Get-Item C:\Windows\System32\drivers\csc.sys | Select-Object VersionInfo