CVE-2026-72947: Windows File History Service Escalation

CVE-2026-72947 Overview

CVE-2026-72947 is an integer underflow vulnerability [CWE-191] in the Windows File History Service. An authorized local attacker can trigger the underflow to elevate privileges on an affected system. Microsoft published the advisory on September 8, 2026, and classified the issue as medium severity.

The flaw requires local access and high privileges to exploit, and attack complexity is high. Successful exploitation yields high impact against confidentiality, integrity, and availability. No public proof-of-concept code or in-the-wild exploitation has been reported.

Critical Impact
A local attacker with existing privileges can wrap an unsigned integer in the File History Service to achieve SYSTEM-level code execution on affected Windows hosts.

Affected Products

Windows operating systems containing the File History Service (see Microsoft advisory for build coverage)
Refer to the Microsoft CVE-2026-72947 Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72947 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72947

Vulnerability Analysis

The File History Service (fhsvc) is a Windows component that backs up user files to secondary storage. The service runs with SYSTEM privileges and processes user-controlled inputs when scheduling and executing backup operations. An integer underflow in this attack surface allows an authorized local attacker to influence size or length calculations used by the service.

When an unsigned arithmetic operation wraps below zero, subsequent memory operations may reference undersized buffers or oversized regions derived from the wrapped value. This creates a path from a low-privilege input to a high-privilege memory corruption primitive inside the service. The result is local privilege escalation from the attacker's existing user context to SYSTEM.

Exploitation requires the attacker to already hold high privileges on the target and to win specific runtime conditions, which is reflected in the high attack complexity. No user interaction is required.

Root Cause

The root cause is an integer underflow (wrap or wraparound) categorized as [CWE-191]. Arithmetic on an unsigned value in the File History Service produces a wrapped result when subtracting a larger value from a smaller one. That wrapped value is then trusted by downstream logic that performs allocation, indexing, or bounds validation.

Attack Vector

The attack vector is local. The attacker interacts with the File History Service through its exposed interfaces from an authenticated Windows session. By crafting inputs that force the underflow condition, the attacker corrupts service state and pivots to SYSTEM execution. Microsoft has not published exploitation prerequisites beyond the CVSS metadata. Refer to the Microsoft CVE-2026-72947 Update Guide for vendor-supplied technical details.

Detection Methods for CVE-2026-72947

Indicators of Compromise

Unexpected crashes, hangs, or restarts of the fhsvc service or the File History Service process
New SYSTEM-level processes spawned as children of svchost.exe hosting fhsvc
Anomalous writes to File History configuration paths under %LOCALAPPDATA%\Microsoft\Windows\FileHistory
Local user accounts performing repeated File History configuration changes prior to a privilege change event

Detection Strategies

Monitor Windows Service Control Manager events (Event IDs 7031, 7034) for repeated failures of the File History Service
Alert on process creation events where fhsvc.exe or its host svchost.exe instance spawns interactive shells or LOLBins
Correlate File History Service crashes with subsequent token elevation or new SYSTEM logon sessions from the same user

Monitoring Recommendations

Enable Windows Error Reporting collection to capture crash dumps of fhsvc for post-incident analysis
Forward Sysmon Event ID 1 (process create) and Event ID 11 (file create) for File History paths to a centralized log platform
Baseline normal File History activity per host and alert on deviations, especially on servers where the service is rarely used

How to Mitigate CVE-2026-72947

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-72947 Update Guide as soon as testing permits
Inventory endpoints and servers running the File History Service and prioritize multi-user systems
Restrict interactive logon on systems where local user access is not required

Patch Information

Microsoft addresses CVE-2026-72947 through its September 2026 update cycle. Consult the Microsoft CVE-2026-72947 Update Guide for the specific KB articles and build numbers that apply to each supported Windows version.

Workarounds

Disable the File History Service (fhsvc) on systems that do not use File History backups
Enforce least privilege so that fewer accounts meet the high-privilege precondition required for exploitation
Apply application control policies to block untrusted binaries from interacting with File History interfaces

bash

# Disable the File History Service on hosts that do not require it
sc.exe config fhsvc start= disabled
sc.exe stop fhsvc