CVE-2026-78516: Windows 10 1607 Information Disclosure

CVE-2026-78516 Overview

CVE-2026-78516 is a buffer over-read vulnerability [CWE-126] in the Windows Storage component. An attacker with physical access to an affected system can read memory beyond an allocated buffer, disclosing sensitive information from process memory. The flaw requires user interaction and does not allow modification of data or disruption of service.

Microsoft assigned this issue a CVSS 3.1 base score of 4.3 and published the advisory on September 8, 2026. The vulnerability affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and from Windows 10 1607 through Windows 11 26H1.

Critical Impact
Physical adversaries can read out-of-bounds memory from the Windows Storage subsystem, exposing confidential data from kernel or driver buffers on unpatched hosts.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-78516 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-78516

Vulnerability Analysis

The vulnerability resides in the Windows Storage subsystem, which handles disk, volume, and storage device operations across all supported Windows editions. A buffer over-read occurs when code reads past the end of an allocated buffer, returning adjacent memory contents to the caller. Under CWE-126, this pattern typically stems from missing bounds checks on length fields controlled by external input.

Exploitation requires physical proximity to the target and user interaction, such as inserting removable storage media or triggering a storage-related operation. Successful exploitation discloses confidential data from the storage stack, which may include cryptographic material, filesystem metadata, or fragments of user data resident in memory. Integrity and availability remain unaffected, so the vulnerability does not enable code execution or denial of service on its own.

The issue is classified as medium severity because the physical attack vector and user-interaction requirement limit remote or network-based exploitation. The EPSS probability score at publication reflects a low likelihood of observed exploitation in the short term.

Root Cause

The root cause is an out-of-bounds read within a Windows Storage driver or user-mode component that processes attacker-controllable size or offset values without validating them against the actual buffer length. When the affected routine copies or returns data based on the untrusted size, it exposes memory beyond the source buffer.

Attack Vector

The CVSS vector AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates a physical attack vector with low complexity, no privileges required, and required user interaction. A representative scenario involves an attacker connecting a crafted USB storage device or removable media to an unlocked or logged-in workstation. When the operating system enumerates or mounts the device, the vulnerable Storage code path processes attacker-supplied metadata and returns over-read memory contents that the attacker can retrieve through the device interface.

No public proof-of-concept exploit code has been published for CVE-2026-78516, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2026-78516 advisory for vendor technical details.

Detection Methods for CVE-2026-78516

Indicators of Compromise

Unexpected mount, format, or enumeration events for removable storage devices on systems left unattended or in shared physical locations.
Windows Storage service or driver crashes and anomalous event log entries referencing storage stack components around the time of USB or removable media insertion.
Presence of unknown or unauthorized USB storage identifiers in the USBSTOR registry hive on high-value endpoints.

Detection Strategies

Correlate physical badge access or workstation unlock events with removable media insertion telemetry to identify unexpected access patterns.
Alert on new USB storage device VID/PID combinations attached to endpoints handling sensitive data, particularly outside normal working hours.
Monitor for repeated storage stack faults or anomalous driver behavior that may indicate probing of the vulnerable code path.

Monitoring Recommendations

Enable Windows event auditing for device installation events (Event IDs 20001, 20003) and forward logs to a centralized analytics platform.
Baseline authorized removable storage inventory per endpoint and alert on deviations.
Track patch compliance for Windows Storage cumulative updates across the fleet, prioritizing servers and shared workstations.

How to Mitigate CVE-2026-78516

Immediate Actions Required

Deploy the September 2026 Microsoft security update that addresses CVE-2026-78516 across all affected Windows client and server versions.
Prioritize patching for endpoints in physically accessible locations such as kiosks, shared workstations, conference rooms, and reception areas.
Enforce screen lock and BitLocker full-disk encryption to reduce the value of physical access to unattended machines.

Patch Information

Microsoft has released a security update addressing CVE-2026-78516. Refer to the Microsoft Security Update Guide entry for CVE-2026-78516 for the specific KB articles corresponding to each affected Windows build. Apply the update through Windows Update, Windows Server Update Services (WSUS), or the enterprise patch management tool of record.

Workarounds

Restrict physical access to endpoints and servers through locked enclosures, secure racks, and controlled facility access.
Disable or restrict USB mass storage device installation via Group Policy (Computer Configuration > Administrative Templates > System > Device Installation Restrictions) on systems that do not require removable media.
Configure endpoints to require authentication before mounting removable storage, and enforce automatic screen lock after short idle periods.