CVE-2026-78452: Windows SCSI Information Disclosure Flaw

CVE-2026-78452 Overview

CVE-2026-78452 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Small Computer System Interface (SCSI) Class System File. An attacker with physical access to a target device can trigger the flaw to read memory outside the intended buffer boundaries. Successful exploitation leads to information disclosure from kernel memory regions handled by the SCSI class driver.

The vulnerability requires physical attack proximity and no privileges or user interaction. Confidentiality impact is high, while integrity and availability remain unaffected. Microsoft published the advisory on September 8, 2026.

Critical Impact
An unauthorized attacker with physical device access can disclose sensitive information from Windows kernel memory by exploiting improper bounds checking in the SCSI class driver.

Affected Products

Microsoft Windows (SCSI Class System File component)
Refer to the Microsoft CVE-2026-78452 Advisory for the complete list of affected Windows versions and builds

Discovery Timeline

2026-09-08 - CVE-2026-78452 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-78452

Vulnerability Analysis

The vulnerability resides in the Windows SCSI Class System File, a kernel-mode component that handles SCSI command processing and device class abstractions. The driver fails to properly validate buffer boundaries when reading structured data during SCSI transactions. This produces an out-of-bounds read condition [CWE-125].

An attacker leverages the flaw by presenting a crafted storage device or manipulated SCSI-attached hardware to the target system. When Windows enumerates or communicates with the device, the SCSI class driver reads beyond the intended buffer. The returned data can include adjacent kernel memory contents. This memory may hold sensitive material such as cryptographic keys, credential fragments, or pointers useful for bypassing kernel address space layout randomization.

The attack requires physical proximity to the target hardware. This constraint limits mass exploitation but remains relevant for supply-chain interception, evil-maid scenarios, and environments where devices are left unattended or shared. No user interaction or authentication is required once the malicious device is connected.

Root Cause

The root cause is missing or insufficient bounds validation in a read operation within the SCSI class driver. When the driver processes device-supplied structures, it trusts fields describing lengths or offsets without confirming they fall within the allocated buffer. The result is a read past the buffer end into unrelated kernel memory.

Attack Vector

The attack vector is physical. An attacker connects a rogue SCSI-compatible device, tampered USB-attached storage adapter, or a peripheral that emulates SCSI class behavior. During device probing or command handling, the driver dereferences attacker-controlled length or index values. The disclosed memory contents are then extracted through subsequent SCSI responses or observable driver behavior. See the Microsoft CVE-2026-78452 Advisory for vendor technical details.

Detection Methods for CVE-2026-78452

Indicators of Compromise

Unexpected SCSI or storage class device enumeration events in Windows event logs, particularly from unfamiliar hardware IDs
Repeated attach and detach cycles of SCSI-class peripherals on endpoints that do not routinely handle removable storage
Kernel driver anomalies or crashes originating in the SCSI class stack shortly after new peripheral connections

Detection Strategies

Monitor Windows PnP and storage subsystem event logs for insertion of SCSI class devices with unrecognized vendor or product identifiers
Correlate physical access events, such as badge-in records or console logons, with device attach events to identify unauthorized peripheral use
Baseline expected storage hardware per endpoint and alert on deviations, especially on kiosks, executive workstations, and lab machines

Monitoring Recommendations

Enable device installation auditing and forward events to a centralized log platform for retention and analysis
Track USB and SCSI device connections through endpoint telemetry to detect out-of-policy peripherals
Review kernel telemetry for read faults or exception events tied to scsiport.sys, storport.sys, and related class driver binaries

How to Mitigate CVE-2026-78452

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-78452 Advisory across all affected Windows systems
Restrict physical access to endpoints and servers, especially in shared, public, or unattended environments
Enforce device control policies that block unauthorized SCSI-class and USB storage peripherals

Patch Information

Microsoft has released a security update addressing CVE-2026-78452. Administrators should consult the Microsoft CVE-2026-78452 Advisory to identify the specific KB articles and update packages applicable to each affected Windows version. Deploy patches through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or an equivalent enterprise patch management platform.

Workarounds

Disable or physically block unused USB and external storage ports on high-value systems using hardware locks or port disablement
Apply Group Policy or Mobile Device Management controls to prevent installation of removable storage device classes
Enable BitLocker with pre-boot authentication to reduce the value of information disclosed to an attacker with brief physical access

bash

# Configuration example: Group Policy device installation restriction
# Block installation of removable devices via GPO path:
# Computer Configuration > Administrative Templates > System >
#   Device Installation > Device Installation Restrictions >
#   Prevent installation of removable devices = Enabled

# PowerShell: audit currently attached SCSI class devices
Get-PnpDevice -Class SCSIAdapter | Format-Table FriendlyName, InstanceId, Status