CVE-2026-57091: Windows 10 Privilege Escalation Flaw

CVE-2026-57091 Overview

CVE-2026-57091 is a stack-based buffer overflow [CWE-121] in the Windows File History Service. An authorized local attacker can trigger the overflow to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on 2026-07-14, and the issue affects a wide range of supported Windows 10, Windows 11, and Windows Server releases.

Exploitation requires local access and low privileges, but no user interaction. Successful exploitation results in high impact to confidentiality, integrity, and availability of the target host. Administrators should apply Microsoft's July 2026 security updates on all affected builds.

Critical Impact
A local, authenticated attacker can overflow a stack buffer in the File History Service to gain SYSTEM-level privileges on unpatched Windows endpoints and servers.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (24H2, 25H2, 26H1)
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-57091 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-57091

Vulnerability Analysis

The vulnerability resides in the Windows File History Service, a component responsible for maintaining versioned backups of user files. A stack-based buffer overflow occurs when the service processes attacker-controlled input without validating its length against the target stack buffer. Writing past the buffer boundary corrupts adjacent stack memory, including saved return addresses and structured exception handlers.

An authorized attacker interacting with the service locally can craft input that overwrites control flow structures. The attacker can then redirect execution and run code in the security context of the File History Service. Because the service runs with elevated privileges, successful exploitation results in local privilege escalation.

The advisory does not indicate exploitation in the wild, and no public proof-of-concept has been referenced. The EPSS value at publication is 0.361%.

Root Cause

The root cause is missing or insufficient bounds checking on data copied into a fixed-size stack buffer inside the File History Service [CWE-121]. Standard stack mitigations such as /GS cookies and Control Flow Guard reduce reliability but do not fully prevent exploitation when combined with information disclosure or predictable state.

Attack Vector

The attack vector is local. An attacker must first obtain the ability to execute code on the target with at least low-privileged user rights. From there, the attacker interacts with the File History Service through its exposed local interfaces to deliver a malformed input that triggers the overflow. No user interaction is required, and the scope remains unchanged.

Refer to the Microsoft Security Update CVE-2026-57091 advisory for component-level technical details.

Detection Methods for CVE-2026-57091

Indicators of Compromise

Unexpected crashes or restarts of the fhsvc (File History Service) process recorded in the Windows Application or System event logs.
Creation of new SYSTEM-level processes whose parent is svchost.exe hosting the File History Service.
Anomalous file writes or persistence artifacts in %LocalAppData%\Microsoft\Windows\FileHistory created by non-standard user contexts.

Detection Strategies

Hunt for low-privileged user sessions that spawn child processes under the File History Service or that suddenly transition to SYSTEM integrity level.
Alert on Windows Error Reporting entries indicating access violations or stack cookie failures (STATUS_STACK_BUFFER_OVERRUN) in fhsvc.dll.
Correlate service crash events (Event ID 7031, 7034) for the File History Service with subsequent privileged process creation.

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) with command-line logging across all endpoints and servers.
Forward Sysmon process, image load, and service state events to a centralized analytics platform for correlation.
Baseline normal File History Service behavior so deviations in child process creation or memory faults surface quickly.

How to Mitigate CVE-2026-57091

Immediate Actions Required

Apply Microsoft's July 2026 security updates addressing CVE-2026-57091 to all affected Windows 10, Windows 11, and Windows Server builds.
Prioritize patching multi-user systems, jump hosts, and terminal servers where local low-privileged accounts are common.
Audit local account membership and remove unnecessary interactive logon rights to reduce the pool of potential attackers.

Patch Information

Microsoft has released fixes through the standard Windows Update channel. Consult the Microsoft Security Update CVE-2026-57091 advisory for the specific KB articles and build numbers applicable to each supported Windows release.

Workarounds

If patching must be delayed, disable the File History Service (fhsvc) on systems where the feature is not required.
Restrict interactive and remote interactive logon rights so only trusted administrators can access affected hosts locally.
Monitor the File History Service closely with EDR telemetry until updates are deployed enterprise-wide.

bash

# Disable the File History Service on hosts that do not require it
sc.exe config fhsvc start= disabled
sc.exe stop fhsvc

# Verify service state
sc.exe query fhsvc