CVE-2026-71340: Windows File History Service Escalation

CVE-2026-71340 Overview

CVE-2026-71340 is a use-after-free vulnerability [CWE-416] in the Windows File History Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. The vulnerability requires local access and low privileges but has high attack complexity, meaning successful exploitation depends on winning a race condition or meeting specific timing requirements. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
Successful exploitation grants an attacker elevated privileges on the target host, compromising confidentiality, integrity, and availability of the operating system.

Affected Products

Microsoft Windows (File History Service component)
Specific build and version information is published in the Microsoft CVE-2026-71340 Update Guide
Refer to the MSRC advisory for the definitive list of affected SKUs and builds

Discovery Timeline

2026-09-08 - CVE-2026-71340 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71340

Vulnerability Analysis

The vulnerability resides in the Windows File History Service, a component that manages automatic backup of user files to secondary storage. The service contains a use-after-free condition in which memory referenced by an internal object is freed while another code path still holds a pointer to it. When the dangling pointer is subsequently dereferenced, an attacker who has staged controlled data at the freed allocation can influence execution flow within the service process.

Because the File History Service runs with elevated privileges, code executed through the reclaimed allocation inherits those privileges. This transforms a low-privilege local session into full compromise of the host. The high attack complexity indicates that exploitation requires precise timing, likely involving a race between object deallocation and the reuse of the pointer.

Root Cause

The root cause is improper object lifetime management within the File History Service [CWE-416]. A code path releases a heap object without invalidating outstanding references. Concurrent operations then reuse the reference, leading to memory corruption when the attacker controls the contents of the reallocated chunk.

Attack Vector

Exploitation requires local authenticated access. An attacker with a standard user account interacts with the File History Service through its documented interfaces to trigger the vulnerable code path. By racing the free operation and spraying attacker-controlled data into the freed slot, the adversary steers the service into executing crafted logic under SYSTEM context. No user interaction is required.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.27%.

Detection Methods for CVE-2026-71340

Indicators of Compromise

Unexpected crashes or restarts of the fhsvc File History Service, particularly with access violation exceptions
Windows Error Reporting entries referencing the File History Service process
New processes spawned as SYSTEM with parent lineage tracing back to fhsvc.dll or svchost.exe hosting File History
Unusual file writes or scheduled tasks created shortly after File History Service anomalies

Detection Strategies

Monitor for repeated File History Service crashes in the Windows Application and System event logs, which may indicate exploitation attempts against the race condition
Alert on privilege escalation patterns where a standard user session precedes a SYSTEM-level process launch tied to File History
Deploy behavioral endpoint detection that flags anomalous child processes originating from service host processes

Monitoring Recommendations

Enable Windows event auditing for service crashes and process creation (Event IDs 4688, 7031, 7034)
Ingest endpoint telemetry into a centralized platform for correlation across hosts
Track memory integrity and exploit protection events emitted by Windows Defender Exploit Guard
Baseline normal File History Service behavior to surface deviations quickly

How to Mitigate CVE-2026-71340

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-71340 Update Guide to all affected Windows systems
Prioritize patching multi-user workstations and systems where untrusted users can obtain local sessions
Audit local account membership and remove unnecessary interactive logon rights
Validate that endpoint protection is active and reporting to a central console

Patch Information

Microsoft has published fix guidance in the MSRC advisory for CVE-2026-71340. Administrators should deploy the corresponding cumulative update for their Windows build. Confirm patch installation using Get-HotFix or the update history in Windows Update after deployment.

Workarounds

Disable the File History Service (fhsvc) on systems where the backup feature is not required, using sc.exe config fhsvc start= disabled
Restrict local logon rights so only trusted administrators can access affected hosts
Enforce application control policies to limit execution of unauthorized binaries used to stage the race condition

bash

# Configuration example: disable the File History Service where not needed
sc.exe stop fhsvc
sc.exe config fhsvc start= disabled

# Verify installed updates on a Windows host
powershell -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10"