WinFsp Race Condition Flaw Allows Attackers to Gain SYSTEM-Level Access on Windows

A newly disclosed vulnerability in the Windows File System Proxy (WinFsp) could allow a local attacker to gain SYSTEM-level privileges by exploiting a race condition that triggers a kernel heap overflow.

Tracked as CVE-2026-3006, this vulnerability affects WinFsp versions 2.1.25156 and earlier, according to an advisory published by the Cyber Security Agency of Singapore (CSA) on April 27, 2026. The maintainers of WinFsp have released a security update to address the issue, and administrators are urged to upgrade immediately.

WinFsp Race Condition Flaw

WinFsp is an open-source Windows framework that enables developers to build user-mode file systems. It provides a kernel-mode component and supporting libraries that allow applications to expose custom storage backends, virtual file systems, and network-based file services to Windows through standard file-system interfaces.

CSA has classified the issue as a race condition flaw. A race condition occurs when the behavior of software depends on the timing or ordering of concurrent operations. This can allow an attacker to manipulate a resource while it is being checked, accessed, or released.

In this case, successful exploitation could lead to a kernel heap overflow in the WinFsp driver. Kernel heap overflows are particularly dangerous because they can corrupt memory managed by the operating system kernel. An attacker who can consistently control the affected memory corruption may be able to execute code with elevated privileges.

The advisory warns that exploitation may result in local privilege escalation, granting the attacker SYSTEM-level access to the affected software and host.

The Windows SYSTEM account has extensive privileges, including the ability to modify protected files, install persistent services or drivers, turn off security controls, access sensitive local data, and create or modify user accounts.

It’s important to note that this flaw is a local privilege-escalation vulnerability rather than a remote code execution issue. Generally, an attacker would need an initial foothold on the targeted device, such as through access via a compromised standard user account, malware execution, a malicious application, or another separately exploited vulnerability.

However, privilege-escalation flaws remain significant in real-world attack chains. Threat actors often use them after gaining low-privileged access to bypass Windows security boundaries, establish persistence, evade endpoint protections, or expand access within an enterprise environment.

Organizations that use applications that bundle or depend on WinFsp should verify both the installed driver and package versions. As WinFsp is frequently used as a component in third-party file-system and storage applications, administrators should also assess vendor-provided software for embedded vulnerable versions.

CSA recommends updating affected installations to the latest available WinFsp release. The security update is available in the WinFsp v2.2B1 release.

Security teams should prioritize remediation on systems where WinFsp is installed alongside privileged services, shared storage tools, file-system virtualization software, or developer utilities.

Until patches are deployed, organizations should limit local administrative access, monitor for suspicious changes to drivers or services, and investigate any unexpected processes that interact with WinFsp-related components.

Security researcher Tay Kiat Loong reported this vulnerability in accordance with CSA’s Responsible Vulnerability Disclosure Policy.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN