CVE-2026-72985: Windows Volume Shadow Copy Privilege Escalation

CVE-2026-72985 Overview

CVE-2026-72985 is a heap-based buffer overflow [CWE-122] in the Windows Volume Shadow Copy Service (VSS). The flaw allows an unauthorized attacker with physical access to a target system to elevate privileges. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability on the affected host.

Microsoft published the advisory on September 8, 2026. The vulnerability requires no prior authentication and no user interaction, but the attack vector is physical, which limits real-world exploitability compared to remote or local network flaws.

Critical Impact
An attacker with hands-on access to a Windows host can corrupt heap memory in the Volume Shadow Copy Service and gain elevated privileges, resulting in full system compromise.

Affected Products

Microsoft Windows (Volume Shadow Copy Service component)
Refer to the Microsoft Vulnerability Update CVE-2026-72985 advisory for the complete list of affected builds
Systems where physical device access cannot be strictly controlled

Discovery Timeline

2026-09-08 - CVE-2026-72985 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-72985

Vulnerability Analysis

The Volume Shadow Copy Service coordinates the creation of consistent point-in-time snapshots of storage volumes on Windows. It is used by backup software, System Restore, and shadow copies for shared folders. VSS runs with elevated privileges and processes data structures from local devices and volumes.

A heap-based buffer overflow [CWE-122] in VSS lets an attacker with physical access write beyond the bounds of an allocated heap buffer. Overwriting adjacent heap metadata or function pointers enables control-flow hijacking in a privileged process context. The result is privilege elevation on the local machine, with high impact to confidentiality, integrity, and availability.

Root Cause

The root cause is insufficient bounds checking when VSS parses attacker-controlled input from a physically attached storage device or volume. A crafted structure triggers an oversized copy into a fixed-size heap allocation, corrupting adjacent memory.

Attack Vector

Exploitation requires physical presence at the target machine, for example, attaching a malicious USB storage device or specially crafted removable media. Once the volume is enumerated by VSS, the malformed structures trigger the overflow and grant the attacker elevated privileges. No credentials and no user interaction are required.

See the Microsoft Vulnerability Update CVE-2026-72985 advisory for technical details.

Detection Methods for CVE-2026-72985

Indicators of Compromise

Unexpected crashes or restarts of the VSS service (vssvc.exe) recorded in the System event log.
Creation of new local administrator accounts or scheduled tasks shortly after removable media is inserted.
Loading of unsigned or unusual drivers immediately following a physical device connection event.
Anomalous child processes spawned by vssvc.exe running under NT AUTHORITY\SYSTEM.

Detection Strategies

Correlate removable media insertion events (Event ID 20001, 20003) with subsequent VSS crashes or privilege changes.
Monitor process creation telemetry for suspicious children of vssvc.exe or svchost.exe hosting VSS.
Flag Windows Error Reporting entries referencing heap corruption in VSSAPI.dll or related modules.

Monitoring Recommendations

Enable audit policies for removable storage access and process creation with command line logging.
Forward VSS-related event logs to a centralized data lake for correlation with endpoint telemetry.
Baseline normal VSS activity to make anomalous crashes and privilege escalations easier to detect.

How to Mitigate CVE-2026-72985

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory as soon as it is available for your Windows build.
Restrict physical access to servers, workstations, and kiosks that store or process sensitive data.
Disable or restrict use of removable storage devices on high-value systems through group policy.

Patch Information

Microsoft addresses CVE-2026-72985 through its standard security update channels. Administrators should consult the Microsoft Vulnerability Update CVE-2026-72985 page to identify the specific KB article and cumulative update that applies to each Windows version deployed in the environment.

Workarounds

Enforce full-disk encryption with pre-boot authentication to reduce the value of unattended physical access.
Configure USB port control and device installation restrictions using Group Policy or endpoint controls.
Physically secure endpoints in locked enclosures where feasible, especially in shared or public spaces.
Disable AutoPlay and AutoRun for removable media across the fleet.

bash

# Configuration example: block installation of removable storage devices via Group Policy
# Computer Configuration > Administrative Templates > System > Device Installation >
#   Device Installation Restrictions > Prevent installation of removable devices = Enabled

# Disable AutoPlay for all drives via registry
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" \
    /v NoDriveTypeAutoRun /t REG_DWORD /d 0xFF /f