CVE-2026-69582

Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69334

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-69291

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

EUVD-2026-73737

Heap-based buffer overflow in Windows Volume Shadow Copy allows an unauthorized attacker to elevate privileges with a physical attack...

EUVD-2026-73685

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-69334

CVE-2026-69334 is a heap-based buffer overflow in the Windows Volume Manager Extension Driver that allows an unauthorized attacker to execute code over a network. The CVSS 3.1 base score is 8.8 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network-reachable remote code e...

CVE-2026-69291

A heap-based buffer overflow in the Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code remotely over a network. The vulnerability is rated CVSS 8.8 (HIGH) with an attack vector of network, low complexity, no privileges required, and user interaction required. ...

EUVD-2026-73684

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

CVE-2026-77904

CVE-2026-77904 is a heap-based buffer overflow in the Windows Volume Manager Extension Driver that allows an attacker with low privileges to achieve local privilege escalation without user interaction. The vulnerability is rated HIGH (CVSS 7.8) with high impact on confidentiality, integrity, and ...

EUVD-2026-73008

Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69582

CVE-2026-69582 is a buffer over-read vulnerability in the Windows Volume Manager Extension Driver , identified by Microsoft (CNA). An authorized local attacker with low privileges can exploit this flaw to elevate privileges locally, achieving high impact on confidentiality, integrity, and availab...

EUVD-2026-72987

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally...

Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability

Buffer over-read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally...

Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network...

Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally...

CVE-2021-36934-export-shadow-volume-POC

CVE-2021–36934 派生哈希用于伪造，例如 PTH 和票据。这里不做详细分析。 此外，考虑到可以获取大多数系统文件的访问权限，利用方法应该不止这一种，包括微软官方也将其定性为权限提升漏洞。 使用一个简单的脚本从卷影中导出文件，仅提供思路。鉴于没有管理员权限，自己编写更容易，而且比 mimikatz 更容易免杀，效果应该更好。每个人看法不同。 Windows 10 版本 1809 之后的所有版本...

CVE-2026-40380 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability

...

EUVD-2026-26412

Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a...

CVE-2026-7461 OS Command Injection in Amazon ECS Agent via FSx Windows File Server Volume Credentials

Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounting component in Amazon ECS Agent on Windows before version 1.103.0 might allow a remote authenticated threat actor to execute shell commands with SYSTEM privileges on the underlying host via a...

Conti Ransomware

Conti is a sophisticated Ransomware-as-a-Service RaaS model first detected in December 2019. Since its inception, its use has grown rapidly and has even displaced the use of other RaaS tools like Ryuk. The Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigati...