# CVE-2026-40380 — Windows Volume Manager Extension `volmgrx.sys` Integer Truncation in VHD/VHDX Metadata Parsing (`VMX_DISK_HEADER::Unformat` / `VMX_PHYSICAL_DISK::ReadToc`)

---

## Summary

| | |
|---|---|
| **Product** | Windows — `volmgrx.sys` (Volume Manager Extension driver; VHD/VHDX metadata parsing) |
| **CVE ID** | CVE-2026-40380 |
| **Impact** | Remote Code Execution |
| **MSRC severity** | Important |
| **CVSS** | 6.2 / 5.4 — `CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-122 Heap-based Buffer Overflow; CWE-197 Numeric Truncation Error; CWE-125 Out-of-bounds Read |
| **Delivery** | A crafted VHD/VHDX virtual-disk image parsed by the driver (`AV:P`) |
| **KB / Fixed build** | KB5089549 — `volmgrx.sys` 10.0.26100.8457 (Win11 24H2 x64) |
| **Patch Date** | May 12, 2026 (2026-May) |
| **Pre-patch binary** | `volmgrx.sys` 10.0.26100.1150 — SHA256 `7c0d3f68af9297c167d64c53a31f6dd3dfd01861cdd3fafd6e545ff1bd3eceaa` |
| **Post-patch binary** | `volmgrx.sys` 10.0.26100.8457 — SHA256 `8ad69577e078b5d605a7e9d814df34b8bb049715fc3656eb043d9319b977c864` |
| **Feature flag** | `Feature_3984574778` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`volmgrx.sys` is the Windows Volume Manager Extension (dynamic-disk) driver. It
parses **VHD/VHDX** virtual-disk metadata — the disk header and its table of
contents (TOC) — in kernel. Fields such as sector counts, offsets and sizes are
stored on disk as **64-bit QWORDs**. Because a crafted disk image can drive this
kernel parser, a size-handling flaw is a code-execution vector (physical/`AV:P`:
the malicious image must be attached/mounted).

---

## Vulnerability Summary

The core defect is **integer truncation** (CWE-197): 64-bit metadata values read
from the disk image are used in 32-bit operations without range validation, so a
value's low 32 bits are used for one purpose (e.g. bitmap validation) while the
full 64-bit value is used for another (comparison / memory operation), producing
a **semantic mismatch** between the value that was validated and the value that
drives the actual access.

**`VMX_DISK_HEADER::Unformat`** — the total sector count, the TOC sector pair, the
log/configuration sectors and two extension offsets (seven 64-bit header fields)
were **not checked against `0xFFFFFFFF`** before being passed into subsequent
32-bit calculations/fields.

**`VMX_PHYSICAL_DISK::ReadToc`** — a TOC entry's offset (`*((QWORD*)entry + 5)`)
and size (`*((QWORD*)entry + 6)`) are read as QWORDs, but bitmap validation uses
only the low 32 bits. A crafted entry with e.g. `0x1_0000_0001` is validated as
`1` yet processed with the original 64-bit value, so validation and use diverge.

Combined, a crafted VHD/VHDX can induce truncation and a size-validation
mismatch; during TOC parsing a read or write can land **outside the bitmap
boundary**, corrupting adjacent kernel pool structures (CWE-122 / CWE-125).

---

## Prerequisites and Constraints

- `AV:P` / `PR:H`: an attacker gets the driver to parse a crafted VHD/VHDX image
  (attach/mount). No user interaction beyond that.
- Trigger: header fields or TOC offset/size set so the low 32 bits pass
  validation while the full 64-bit value drives the memory operation.
- Result is out-of-bounds kernel access / pool corruption → potential RCE.

---

## Vulnerability Details

### Root Cause

64-bit disk metadata (sector numbers, offsets, sizes) is consumed by 32-bit code
paths without first verifying it fits in 32 bits, so truncation lets the value
used for bounds validation differ from the value used for the actual access.

### The patch (confirmed — diff, .1150 → .8457)

Gated behind `Feature_3984574778`, both functions add explicit upper-bound and
summation-overflow checks **before** the 64-bit values are used as 32-bit.

`VMX_DISK_HEADER::Unformat` — seven header fields must each be `< 0x100000000`:

```c
// VMX_DISK_HEADER::Unformat (10.0.26100.8457) — PATCHED, feature-enabled branch
if ( Feature_3984574778__private_IsEnabledDeviceUsageNoInline() == 0
  || ( *(u64*)(this+0xa0) < 0x100000000 && *(u64*)(this+0x18) < 0x100000000
    && *(u64*)(this+0x20) < 0x100000000 && *(u64*)(this+0xa8) < 0x100000000
    && *(u64*)(this+0xb0) < 0x100000000 && *(u64*)(this+0xc0) < 0x100000000
    && *(u64*)(this+0xc8) < 0x100000000 ) )
{ *param_1 = ...; return 0; }   // accept only when every 64-bit field fits in 32 bits
```

`VMX_PHYSICAL_DISK::ReadToc` — per TOC entry, reject when offset or size exceeds
`0xFFFFFFFF`, or when their **sum** overflows 32 bits, and break out of the
parsing loop (the TOC buffer/objects are then cleaned up):

```c
// VMX_PHYSICAL_DISK::ReadToc (10.0.26100.8457) — PATCHED, feature-enabled branch
if ( Feature_3984574778__private_IsEnabledDeviceUsageNoInline()
  && ( 0xffffffff < *(u64*)(entry+0x28)                    // offset > 0xFFFFFFFF
    || 0xffffffff < *(u64*)(entry+0x30)                    // size   > 0xFFFFFFFF
    || 0xffffffff < *(u64*)(entry+0x30) + *(u64*)(entry+0x28) ) )   // offset+size overflow
{ break; }                                                 // stop trusting this TOC entry
```

Entry offset `+0x28` and size `+0x30` correspond to QWORD indices 5 and 6 —
exactly the `v49`/`v48` fields in the public analysis. If the check fails the loop
exits before any access based on the invalid values.

### Patch Completeness Assessment

**CFR-gated behind `Feature_3984574778`.** The checks run only when the flag is
enabled; the original unchecked parsing still ships in .8457. Patch state is not
determined by file version alone — the runtime-gated pattern seen across this
corpus. Verify `Feature_3984574778` is enabled to confirm the bounds are live.

---

## Detection Guidance

**Behavioural.** Attaching/mounting untrusted VHD/VHDX images; disk headers or
TOC entries whose 64-bit sector/offset/size fields exceed `0xFFFFFFFF`.

**Crash signature.** Kernel pool corruption / out-of-bounds access in
`volmgrx!VMX_PHYSICAL_DISK::ReadToc` or `VMX_DISK_HEADER::Unformat` while parsing
a virtual disk on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_3984574778` is enabled so the
`> 0xFFFFFFFF` bounds are active.

---

## References

- MSRC advisory — CVE-2026-40380 (Windows Volume Manager Extension Driver Remote Code Execution), released 2026-05-12, KB5089549.
- Full binary diff: `/data/patch_diffs/volmgrx_sys-cve-2026-40380-ghidriff.md`