VulnSocial

CVE-2026-3006Patch

LOWCVSS 7.0 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to the affected software.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-362CWE-368

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 11 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 7 signals
  • Technical details provided in 8 signals
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • Peaked 4d ago at 3 mentions (2026-04-27); latest day: 1
  • 11 total mentions across 6 days

Deep dive

Activity timeline11 mentions / 6d
01223Mentions · 2026-04-22: 1Mentions · 2026-04-27: 3Mentions · 2026-05-07: 2Mentions · 2026-05-08: 1Mentions · 2026-07-14: 3Mentions · 2026-07-22: 1PoC Mentioned / Linked · 2026-05-07: 1Patch / Workaround · 2026-04-22: 1Patch / Workaround · 2026-05-07: 2Patch / Workaround · 2026-07-14: 3Patch / Workaround · 2026-07-22: 1Technical Details · 2026-04-27: 2Technical Details · 2026-05-07: 2Technical Details · 2026-07-14: 3Technical Details · 2026-07-22: 104-2204-2705-0705-0807-1407-22
Signal classification4 categories
Patch
654.5%
Disclosure
218.2%
General
218.2%
PoC
19.1%
Referenced assets8 URLs
Classification over time
DateTotalLabels
2026-04-221
Patch1
2026-04-273
Disclosure2General1
2026-05-072
Patch1PoC1
2026-05-081
General1
2026-07-143
Patch3
2026-07-221
Patch1
Full discourse11 posts
  • malware Owl@malware_owl
    PoC

    Happen to find CVE-2026-3006 :D TL;DR: A TOCTOU bug. When trying to understand it to implement in a project that I was working on. Kudos to maintainer @BZissimopoulos for swift actions and fixes! The Story: While trying looking for ready made drivers for a project that I am working on, I chanced upon WinFSP. The question I had at the time was whether we could extract some file information using the driver without the need to implement kernel driver. However, as I was reading the implementation in a single screen, I spotted the a common pattern (Multi-fetch of size which is used in ExAllocatePool). After writing an exploit to show crash and fully exploit the driver to get SYSTEM, I was given CVE-2026-3006. The affected driver version can be exploited from Low Integrity CMD as well. Licensees that are using WinFSP or users using any tool that uses WinFSP under the hood are advised to upgrade to the new version of WinFSP! Demo (YouTube): https://youtu.be/aHV7GEBgy5Q

    Post summary

    The post reports a found TOCTOU flaw in WinFSP, confirms that the writer developed a proof‑of‑concept exploit, and recommends upgrading to the patched driver.

    63621569791.3K
    1.1K followersView on X
  • Kaspersky@kaspersky
    Patch

    Nice catch from @malware_owl - CVE-2026-3006: a TOCTOU in WinFSP that takes you from Low Integrity CMD to SYSTEM. Patched. Credit to @BZissimopoulos for the fast fix. If WinFSP is in your stack or under the hood of a tool you use, update. 👇

    Post summary

    The tweet announces CVE‑2026‑3006—a TOCTOU privilege‑escalation flaw in WinFSP—that has already been patched, urging users to update.

    04027155.2K
    312.6K followersView on X
  • Bill Zissimopoulos@BZissimopoulos
    Patch

    WinFsp 2026 Beta1 has been released: https://github.com/winfsp/winfsp/releases/tag/v2.2B1 It includes an important fix to a vulnerability (CVE-2026-3006) discovered by Tay Kiat Loong. I recommend everyone upgrade to this WinFsp version as the vulnerability will shortly become public.

    Post summary

    The tweet announces the WinFsp 2026 Beta1 release, noting it includes a fix for CVE‑2026‑3006 and recommends upgrading.

    13051784
    273 followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    WinFsp vulnerabilities CVE-2026-3006 and CVE-2026-7162 enable local privilege escalation to SYSTEM on Windows. Update to WinFsp 2026 Beta2 now. #WinFsp #CVE20263006 #CVE20267162 #PrivilegeEscalation #CyberSecurity http://securityonline.info/winfsp-vulnerabilities/

    Post summary

    The tweet announces that CVE-2026-3006 and CVE-2026-7162 in WinFsp allow local privilege escalation and recommends applying the WinFsp 2026 Beta2 update to mitigate the risk.

    01030499
    12.9K followersView on X
  • CVETrends@CVEShield
    General

    Top 5 Trending CVEs: 1 - CVE-2026-3006 2 - CVE-2022-0847 3 - CVE-2026-6973 4 - CVE-2026-31431 5 - CVE-2026-29014 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

    Post summary

    The post merely lists five CVEs as trending without any additional technical or operational details.

    00020140
    1.7K followersView on X
  • iototsecnews@iototsecnews
    Patch

    WinFsp の競合状態の脆弱性 CVE-2026-3006 が FIX：Windows SYSTEM 権限奪取の恐れ https://iototsecnews.jp/2026/07/14/winfsp-race-condition-flaw-allows-attackers-to-gain-system-level-access-on-windows/ Windows File System Proxy (WinFsp) の特定のバージョンには、並行処理の隙を突いてメモリ管理の仕組みを狂わせる競合状態という問題が隠れていました。この脆弱性 CVE-2026-3006 が、すでにシステムへ侵入している攻撃者により悪用されると、OSの核心部を制御できる最高位の管理者権限を奪われてしまう危険性があります。もし乗っ取られた場合は、セキュリティ機能の停止や重要データの窃取などが引き起こされる恐れがあるため注意が必要です。対応策としては、開発ツールやストレージソフトの部品として組み込まれている本製品のバージョンを確認し、速やかに修正済みの v2.2B1 以降へとアップデートする必要があります。 #CVE20263006 #Vulnerability #WindowsFileSystemProxy #WinFsp

    Post summary

    The post describes a race‑condition flaw (CVE‑2026‑3006) in WinFsp that could lead to SYSTEM privilege escalation if exploited by attackers already inside a system, and urges users to apply the patched v2.2B1 release.

    01000242
    500 followersView on X
  • ThreatWire@ThreatWire_
    Patch

    🚨 CVE-2026-3006 & CVE-2026-7162: Two WinFsp vulnerabilities could allow local privilege escalation to SYSTEM on Windows. Update to WinFsp 2026 Beta2. #CyberSecurity #CVE #Windows #WinFsp #ThreatWire

    Post summary

    WinFsp has two CVEs that could enable local privilege escalation to SYSTEM; users are advised to update to WinFsp 2026 Beta2.

    0001049
    87 followersView on X
  • CVE@CVEnew
    General

    CVE-2026-3006 Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation… https://www.cve.org/CVERecord?id=CVE-2026-3006

    Post summary

    The passage describes a race condition in CVE‑2026‑3006 that can cause a kernel heap overflow and local privilege escalation, but offers no evidence of PoC, exploit code, active attacks, patches, or debunking.

    0000195
    57.3K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-3006 Local Privilege Escalation via Race Condition Kernel Heap Overflow https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3006

    Post summary

    The post announces CVE-2026-3006 as a local privilege escalation flaw caused by a race condition kernel heap overflow, without providing PoC, exploit details, or patch information.

    0000145
    4.0K followersView on X
  • TECHEPAGES@techepages
    Patch

    🚨 A race-condition flaw (CVE-2026-3006) in WinFsp — the open-source framework powering tools like SSHFS-Win, rclone mounts & cloud-storage clients — lets local attackers trigger a kernel heap overflow and escalate privileges to SYSTEM, full control of the machine. ⚠️ Since WinFsp runs kernel-level drivers, a flaw here affects every file system built on top of it. Singapore's CSA disclosed the bug, and a patched release is already available on GitHub. 🔹 All WinFsp versions 2.1.25156 and earlier are vulnerable 🔹 Exploitation needs precise timing, but SYSTEM payoff makes it attractive

    Post summary

    A race‑condition flaw (CVE‑2026‑3006) in WinFsp enables local attackers to trigger a kernel heap overflow and achieve SYSTEM privileges. A patched release is already available on GitHub.

    0000047
    21 followersView on X
  • CVEarity@CVEarity
    Disclosure

    ⚡ New CVE Alert: CVE-2026-3006 📊 Severity: 7.0 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-3006 #CVE-2026-3006 #CVE #High #CyberSecurity #InfoSec https://t.co/aT5AhkWh2z

    Post summary

    The tweet announces a new vulnerability (CVE-2026-3006), provides a severity score and risk level, and links to the NVD entry but offers no deeper technical information or mitigation steps.

    0000051
    141 followersView on X

Explore more

Back to dashboard