CVE-2026-59128 Overview
CVE-2026-59128 is an out-of-bounds read vulnerability [CWE-125] in the Windows Encrypting File System (EFS). An authenticated local attacker can read memory beyond the intended buffer boundary and disclose sensitive information. The flaw affects a broad range of Microsoft Windows client and server releases, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Exploitation requires local access and low privileges, but no user interaction. The issue is scoped to confidentiality impact only, with no integrity or availability effects reported in the Microsoft advisory.
Critical Impact
An authorized local user can read out-of-bounds memory in the EFS component to disclose information that should not be accessible at their privilege level.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-59128 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-59128
Vulnerability Analysis
The Windows Encrypting File System (EFS) is a driver-backed component that provides transparent file-level encryption on NTFS volumes. CVE-2026-59128 is classified as an out-of-bounds read [CWE-125], meaning EFS reads memory outside the bounds of an allocated buffer during request processing. When an authorized local user issues a crafted request to the EFS interface, the component returns or otherwise exposes adjacent memory contents. The disclosed data can include kernel-mode memory, cryptographic material, or metadata that assists in bypassing address-space layout defenses. Microsoft rates the flaw with high confidentiality impact but no integrity or availability consequences, which is consistent with a read-only information disclosure primitive.
Root Cause
The underlying defect is a missing or insufficient bounds check in an EFS code path that reads from a buffer using an attacker-influenced length or offset. Because the check does not correctly validate the read range against the allocation size, EFS accesses memory beyond the buffer and returns that data to the caller. Microsoft has not released a public technical write-up beyond the Microsoft Security Update Guide.
Attack Vector
Exploitation requires local, authenticated access to an affected system. An attacker with a standard user session invokes the vulnerable EFS interface with parameters that trigger the out-of-bounds read. No user interaction is required, and the scope is unchanged. The vulnerability is not remotely exploitable and has no public proof-of-concept code, exploit database entry, or CISA KEV listing at time of publication.
No verified proof-of-concept code is available for CVE-2026-59128. Refer to the Microsoft Security Update Guide for authoritative technical detail.
Detection Methods for CVE-2026-59128
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-59128.
- Absence of the applicable Microsoft security update on an affected Windows or Windows Server build is the primary risk indicator.
Detection Strategies
- Inventory endpoints and servers against the affected build list and flag hosts missing the August 2026 Microsoft security update addressing CVE-2026-59128.
- Monitor for unusual process behavior interacting with EFS interfaces, particularly repeated or malformed calls from non-administrative user contexts.
- Correlate local logon events with subsequent access to encrypted file objects or EFS-related APIs to identify anomalous exploration patterns.
Monitoring Recommendations
- Enable Windows security auditing for object access on EFS-protected files and forward logs to a centralized analytics platform.
- Track privileged and standard user sessions for signs of information-gathering activity, including memory-inspection tooling and debuggers invoked against system components.
- Review vulnerability management dashboards for patch compliance across Windows 10, Windows 11, and Windows Server fleets identified in the affected products list.
How to Mitigate CVE-2026-59128
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows and Windows Server builds.
- Prioritize patching on multi-user systems, jump hosts, and terminal servers where multiple authenticated users share a host.
- Restrict interactive and remote logon rights to trusted accounts to reduce the pool of users able to trigger the local attack.
Patch Information
Microsoft has published fixes through the Microsoft Security Update Guide. Administrators should deploy the corresponding cumulative update for each affected Windows 10, Windows 11, and Windows Server release. Consult the Microsoft Security Update Guide for the exact KB article and package identifiers per build.
Workarounds
- No official workaround has been published by Microsoft; patching is the supported remediation path.
- Limit local logon rights and enforce least privilege to reduce the number of users who can invoke EFS locally.
- Where EFS is not required, disable use of EFS-encrypted files via Group Policy to shrink the attack surface until patches are deployed.
# Verify installed updates on a Windows host
wmic qfe list brief /format:table
# Trigger Windows Update scan and install available updates
UsoClient StartScan
UsoClient StartDownload
UsoClient StartInstall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
