Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?
To successfully exploit this vulnerability, an attacker or the targeted user would need to achieve a high level of control over a machine, as the attack requires access to processes typically restricted from average users.
Essentially, the exploitation necessitates elevated privileges on the compromised machine due to the requirement of manipulating processes beyond the reach of standard user permissions.
Security updates
10.0.17763.8755 — https://support.microsoft.com/help/5087538
10.0.20348.5139 — https://support.microsoft.com/help/5087545
10.0.20348.5074 — https://support.microsoft.com/help/5087424
10.0.19044.7291 — https://support.microsoft.com/help/5087544
10.0.19045.7417 — https://support.microsoft.com/help/5094127
10.0.26100.32860 — https://support.microsoft.com/help/5087539
10.0.26100.32772 — https://support.microsoft.com/help/5087423
10.0.26200.8457 — https://support.microsoft.com/help/5089549
10.0.26200.8390 — https://support.microsoft.com/help/5089466
10.0.22631.7079 — https://support.microsoft.com/help/5087420
10.0.22631.7219 — https://support.microsoft.com/help/5093998
10.0.25398.2330 — https://support.microsoft.com/help/5087541
10.0.28000.2113 — https://support.microsoft.com/help/5089548
10.0.14393.9140 — https://support.microsoft.com/help/5087537
6.2.9200.26079 — https://support.microsoft.com/help/5087470
6.3.9600.23181 — https://support.microsoft.com/help/5087471
Vulnerabilities 1
-
Medium 6.2
Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
Revision history
-
#1
Information published.
References
-
CVE-2026-40380 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40380
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss