CVE-2026-7162: Integer Overflow Privilege Escalation

CVE-2026-7162 Overview

CVE-2026-7162 is an integer overflow vulnerability [CWE-190] that allows a local, authenticated attacker to escalate privileges to system level on the affected software. The external references point to the Windows File System Proxy (WinFsp) project, with a fix included in the WinFsp v2.2B2 release. The scope-changed impact indicates the flaw crosses a trust boundary, giving the attacker control over resources beyond the vulnerable component. The Cyber Security Agency of Singapore also issued advisory AL-2026-086 covering this issue.

Critical Impact
Successful exploitation of the integer overflow allows a local attacker to achieve system-level access on the affected host.

Affected Products

WinFsp releases prior to v2.2B2
Windows systems running vulnerable WinFsp kernel components
Applications relying on WinFsp for user-mode file system functionality

Discovery Timeline

2026-07-13 - CVE-2026-7162 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-7162

Vulnerability Analysis

The vulnerability is an integer overflow classified under [CWE-190]. Integer overflow flaws occur when an arithmetic operation produces a value that exceeds the storage capacity of its integer type. The resulting truncated or wrapped value bypasses subsequent size and boundary checks. In privileged file system code, this typically leads to undersized buffer allocations followed by out-of-bounds memory writes.

According to the vendor release notes for WinFsp v2.2B2, the flaw resides in code paths reachable through the WinFsp kernel driver. Because WinFsp interfaces between user-mode file system providers and the Windows kernel, an overflow in these paths executes with high privilege. The scope-changed impact reflects that a low-privileged local process can influence memory or control flow inside the kernel component, yielding system-level access.

Root Cause

The root cause is missing or insufficient validation of arithmetic operations on attacker-influenced size, length, or offset values. When these values are combined with other operands, the result overflows the fixed-width integer type. The truncated value is then trusted by downstream allocation or copy routines, producing memory corruption in a privileged context.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. The attacker submits crafted input, such as a specially sized I/O control request, to the vulnerable driver interface. Because attack complexity is high, exploitation likely depends on winning a specific state condition or shaping memory layout. Successful exploitation yields code execution or data tampering at the kernel level. As of publication, no public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE.

Refer to the GitHub WinFsp Release v2.2B2 notes and the CSA Security Alert AL-2026-086 for the vendor-supplied technical details.

Detection Methods for CVE-2026-7162

Indicators of Compromise

Unexpected loading or version mismatch of the WinFsp kernel driver (winfsp.sys or winfsp-x64.sys) on managed endpoints.
New or unsigned user-mode processes issuing DeviceIoControl calls to WinFsp device objects.
Kernel bugcheck events or crashes referencing the WinFsp driver in memory dumps.
Local accounts spawning SYSTEM-owned processes shortly after interacting with a WinFsp-backed file system.

Detection Strategies

Inventory endpoints for installed WinFsp versions and flag any build older than v2.2B2.
Alert on kernel driver load events for WinFsp binaries that do not match approved hashes.
Correlate local user sessions with subsequent process creations running as NT AUTHORITY\SYSTEM.
Monitor Windows Error Reporting and Minidump artifacts for stack traces implicating WinFsp modules.

Monitoring Recommendations

Ingest Sysmon Event ID 6 (driver loaded) and Event ID 1 (process create) into your SIEM and pivot on WinFsp module paths.
Track privilege escalation chains where a non-administrative token is followed by a SYSTEM token in the same session.
Baseline normal WinFsp usage per host so anomalous I/O control traffic can be surfaced.

How to Mitigate CVE-2026-7162

Immediate Actions Required

Upgrade WinFsp to release v2.2B2 or later on every affected endpoint and server.
Remove WinFsp from hosts that do not require user-mode file system functionality.
Restrict interactive and remote local logon rights to trusted administrative accounts.
Validate driver integrity by comparing installed binaries against the hashes published in the vendor release.

Patch Information

The vendor has published the fix in the GitHub WinFsp Release v2.2B2. Additional guidance is available in the CSA Security Alert AL-2026-086. Apply the update through your standard software distribution channel and reboot to unload the vulnerable driver.

Workarounds

Uninstall WinFsp on systems where third-party file system providers are not in use.
Enforce application control policies that block execution of unapproved user-mode WinFsp clients.
Limit membership in local groups that can install or interact with kernel drivers until patching is complete.

bash

# Verify installed WinFsp version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\WinFsp" -ErrorAction SilentlyContinue |
  Select-Object Version, InstallDir

# Confirm the loaded driver matches the patched release
Get-CimInstance Win32_SystemDriver -Filter "Name='WinFsp'" |
  Select-Object Name, State, PathName