CVE-2026-70149: Windows CSC Driver Information Disclosure

CVE-2026-70149 Overview

CVE-2026-70149 is an information disclosure vulnerability in the Windows Client Side Caching driver (csc.sys). The flaw allows an authorized attacker to disclose sensitive information from the affected system. Microsoft tracks the weakness under CWE-122: Heap-based Buffer Overflow, indicating that memory handling errors in the kernel-mode driver can expose data to unauthorized actors.

The advisory describes the attack as local disclosure, while the CVSS vector lists a network attack path requiring user interaction. Successful exploitation impacts confidentiality, integrity, and availability of the targeted Windows host.

Critical Impact
An authorized attacker can trigger memory handling errors in csc.sys to disclose sensitive data processed by the Windows Client Side Caching driver.

Affected Products

Microsoft Windows (versions enumerated in the Microsoft Security Response Center advisory)
Windows Client Side Caching driver component (csc.sys)
Systems using Offline Files functionality backed by csc.sys

Discovery Timeline

2026-10-13 - CVE-2026-70149 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-70149

Vulnerability Analysis

The vulnerability resides in csc.sys, the kernel-mode driver that implements Windows Client Side Caching for the Offline Files feature. The driver caches network share content locally so users can access files when disconnected from the server. Per the Microsoft advisory, improper handling of data within the driver exposes sensitive information to an unauthorized actor.

The weakness is classified as CWE-122: Heap-based Buffer Overflow. Heap corruption in a kernel driver can leak contiguous memory contents, including pool allocations containing cached file data, security tokens, or other kernel structures. Because csc.sys runs in kernel mode, any disclosed memory may contain data belonging to other users or system processes.

Root Cause

The root cause is improper validation of buffer boundaries during cache operations in csc.sys. When the driver copies or processes data in heap-allocated pool memory, the operation reads or returns more data than the intended object size. This exposes adjacent kernel heap contents to the caller.

Attack Vector

The CVSS vector indicates a network attack path (AV:N) requiring user interaction (UI:R), while the description indicates local information disclosure. An authorized user interacting with crafted offline file content or network share data can cause csc.sys to process malformed structures. The resulting memory corruption discloses sensitive kernel data to the attacker-controlled context.

No public proof-of-concept exploit code is available. See the Microsoft CVE-2026-70149 Advisory for vendor technical details.

Detection Methods for CVE-2026-70149

Indicators of Compromise

Unexpected kernel pool allocations or crashes referencing csc.sys in Windows Error Reporting data
Anomalous Offline Files synchronization activity from standard user accounts
Bugcheck events (BSOD) with faulting module csc.sys following interaction with network shares

Detection Strategies

Monitor Windows Event Logs for driver faults, pool corruption events, and BugCheck entries implicating csc.sys
Correlate access to SMB shares with subsequent kernel driver anomalies on client endpoints
Baseline normal Client Side Caching behavior and alert on deviations in cache file read/write patterns

Monitoring Recommendations

Enable kernel-mode telemetry collection on endpoints running Offline Files to capture driver-level anomalies
Track process access to %SystemRoot%\CSC directory and related cache structures
Ingest endpoint telemetry into a centralized data lake for cross-host correlation of csc.sys events

How to Mitigate CVE-2026-70149

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70149 Advisory as soon as available
Inventory Windows endpoints with Offline Files enabled and prioritize patching for those systems
Restrict interactive access on multi-user systems where untrusted users could trigger the flaw

Patch Information

Microsoft provides the official patch through its Security Update Guide. Administrators should consult the Microsoft CVE-2026-70149 Advisory for the specific KB articles, affected build numbers, and update packages that remediate the vulnerability in csc.sys.

Workarounds

Disable the Offline Files feature where it is not required for business operations
Stop and disable the Client Side Caching service on systems that do not need offline access to network shares
Apply Group Policy restrictions to prevent standard users from enabling Offline Files on sensitive endpoints

bash

# Configuration example: disable Offline Files via PowerShell (requires reboot)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CSC" -Name "Start" -Value 4
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\NetCache" -Name "Enabled" -Value 0