CVE-2026-40380 — Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

Executive Summary

Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.

Overview

6.2

CVSS MEDIUM

Important

MS Severity

Not Exploited

MS Exploit Status

Less Likely

MS Exploit Likelihood

Category Remote Code Execution

Weakness CWE-122: Heap-based Buffer Overflow

Released May 12 2026

Last Updated May 12 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

EPSS Score 0.00462 — 0.38047 percentile

NVD CVSS 6.2 MEDIUM — matches MSRC

CVSS Vector

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

ATTACK VECTOR

Physical

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

High

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

High

INTEGRITY

High

AVAILABILITY

High

EXPLOIT CODE MATURITY

Unproven

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 5.4

EPSS Score

0.00462

probability of exploitation in the next 30 days

0.38047 percentile - updated 2026-08-14

View on FIRST.org

Affected Products

23 affected products

Product	KB Article	Severity	Impact	Restart Required
Windows 10 Version 1607 for 32-bit Systems	`5087537 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 1607 for x64-based Systems	`5087537 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 1809 for 32-bit Systems	`5087538 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 1809 for x64-based Systems	`5087538 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 21H2 for 32-bit Systems	`5087544 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 21H2 for ARM64-based Systems	`5087544 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 21H2 for x64-based Systems	`5087544 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 22H2 for 32-bit Systems	`5094127 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 22H2 for ARM64-based Systems	`5094127 (Security Update)`	Important	Remote Code Execution	Yes
Windows 10 Version 22H2 for x64-based Systems	`5094127 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 23H2 for ARM64-based Systems	`5087420 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 23H2 for x64-based Systems	`5093998 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 Version 24H2 for ARM64-based Systems 5089549 (Security Update) 5089466 (Security Hotpatch Update) Important Remote Code Execution 5082063 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.8457 10.0.26100.8390 Yes None Windows 11 Version 24H2 for x64-based Systems 5089549 (Security Update) 5089466 (Security Hotpatch Update) Important Remote Code Execution 5082063 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.8457 10.0.26100.8390 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5089549 (Security Update) 5089466 (Security Hotpatch Update) Important Remote Code Execution 5083769 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.8457 10.0.26200.8390 Yes None Windows 11 Version 25H2 for x64-based Systems 5089549 (Security Update) 5089466 (Security Hotpatch Update) Important Remote Code Execution 5083769 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.8457 10.0.26200.8390 Yes None Windows 11 Version 26H1 for ARM64-based Systems	`5089548 (Security Update)`	Important	Remote Code Execution	Yes
Windows 11 version 26H1 for x64-based Systems	`5089548 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2012	`5087470 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2012 (Server Core installation)	`5087470 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2012 R2	`5087471 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2012 R2 (Server Core installation)	`5087471 (Monthly Rollup)`	Important	Remote Code Execution	Yes
Windows Server 2016	`5087537 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2016 (Server Core installation)	`5087537 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2019	`5087538 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2019 (Server Core installation)	`5087538 (Security Update)`	Important	Remote Code Execution	Yes
Windows Server 2022 5087545 (Security Update) 5087424 (Security Hotpatch Update) Important Remote Code Execution 5082142 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.5139 10.0.20348.5074 Yes None Windows Server 2022 (Server Core installation) 5087545 (Security Update) 5087424 (Security Hotpatch Update) Important Remote Code Execution 5082142 Base: 6.2 Temporal: 5.4 Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.5139 10.0.20348.5074 Yes None Windows Server 2022, 23H2 Edition (Server Core installation)	`5087541 (Security Update)`	Important	Remote Code Execution	Yes

Patches

10 patches

Article	Type	Restart
`5087537`	Security Update	Yes
`5087538`	Security Update	Yes
`5087544`	Security Update	Yes
`5094127`	Security Update	Yes
`5087420`	Security Update	Yes
`5093998`	Security Update	Yes
`5089548`	Security Update	Yes
`5087470`	Monthly Rollup	Yes
`5087471`	Monthly Rollup	Yes
`5087541`	Security Update	Yes

Patch Diff

ghidriff · volmgrx.sys (KB5089549)

Integer-truncation memory corruption (CWE-197 -> CWE-122 heap overflow / CWE-125 OOB read) in the Windows Volume Manager Extension driver volmgrx.sys VHD/VHDX metadata parser, RCE via a crafted virtual-disk image (AV:P). 64-bit QWORD metadata (sector numbers, offsets, sizes) read from the disk image is consumed by 32-bit code without range validation, so the low-32-bit value used for (e.g.) bitmap validation diverges from the full 64-bit value used in comparisons/memory operations. In VMX_DISK_HEADER::Unformat the seven 64-bit header fields (total sector count, TOC sector pair, log/config sectors, two extension offsets) were not checked against 0xFFFFFFFF before use in 32-bit ops. In VMX_PHYSICAL_DISK::ReadToc a TOC entry's offset (QWORD idx 5) and size (QWORD idx 6) are read as QWORDs but bitmap-validated using only the low 32 bits (e.g. 0x1_0000_0001 validates as 1), so during TOC parsing an OOB read/write past the bitmap boundary can corrupt adjacent kernel pool. IN-HOUSE ghidriff of volmgrx.sys 10.0.26100.1150 -> .8457 (May 12 2026, KB5089549) confirms the fix: Unformat adds seven `field < 0x100000000` checks; ReadToc adds `offset > 0xFFFFFFFF || size > 0xFFFFFFFF || offset+size > 0xFFFFFFFF` and breaks the parse loop (cleaning up the TOC buffer); both gated behind CFR flag Feature_3984574778. Note: our x64 24H2 diff shows Feature_3984574778, differing from the circulated screenshots' Feature_4253010234 (build/arch difference); the > 0xFFFFFFFF bounds are identical. We ship what our diff shows.

Pre-patch version 10.0.26100.1150 Download

Post-patch version 10.0.26100.8457 Download

Function	Address	Change	Note
`VMX_DISK_HEADER::Unformat`	`code change`	code (seven 64-bit header-field upper-bound checks, CFR-gated)	Post (Feature_3984574778 enabled): accepts the header only if all seven 64-bit fields are < 0x100000000 - fields at this+0x18, +0x20, +0xa0, +0xa8, +0xb0, +0xc0, +0xc8 (total sector count, TOC sector pair, log/config sectors, two extension offsets). Pre: no such upper-bound check before the values feed 32-bit calculations/fields.
`VMX_PHYSICAL_DISK::ReadToc`	`code change`	code (TOC offset/size/sum overflow check, CFR-gated)	Post (Feature_3984574778 enabled): per TOC entry, break the parse loop if offset ((u64)(entry+0x28), QWORD idx 5) > 0xFFFFFFFF, or size ((u64)(entry+0x30), QWORD idx 6) > 0xFFFFFFFF, or offset+size > 0xFFFFFFFF, then clean up the TOC buffer. Pre: only the low 32 bits were used for bitmap validation while the 64-bit value drove the access -> truncation mismatch -> OOB.
`Feature_3984574778`	`new flag`	added (CFR gate)	New CFR flag introduced by this patch gating both the Unformat and ReadToc range checks; the original unchecked parsing still ships in .8457.

View full diff report View RCA report

Attack Path

A crafted VHD/VHDX supplies 64-bit metadata whose low 32 bits pass validation but whose full value drives an out-of-bounds kernel access

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

No known exploits have been linked for this CVE yet. When available, exploit references will be sourced from public repositories and may be unverified, incomplete, or non-functional. Always review code carefully before use in any environment.

Acknowledgments

Calif.io in collaboration with Claude and Anthropic Research

References

MSRC Advisory MITRE NVD