# CVE-2026-50381 — Windows Composite Image File System `cimfs.sys` Untyped Directory-Query Object in `DispatchVolumeDirectoryControl` → Type Confusion / File-Metadata Disclosure

---

## Summary

| | |
|---|---|
| **Product** | Windows — `cimfs.sys` (Composite Image File System driver; `.cim` volumes) |
| **CVE ID** | CVE-2026-50381 |
| **Impact** | Information Disclosure (file metadata) |
| **MSRC severity** | Important |
| **CVSS** | 5.5 / 4.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C` |
| **CWE** | CWE-843: Access of Resource Using Incompatible Type (Type Confusion) |
| **Delivery** | Local — a directory-control query on a mounted composite image (`.cim`) volume |
| **KB / Fixed build** | KB5101650 — `cimfs.sys` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary** | `cimfs.sys` 10.0.26100.8737 — SHA256 `316bd8c4290bc933b597d63579ec03fbc835249ba2fd57aaec4e3bbf3187f400` |
| **Post-patch binary** | `cimfs.sys` 10.0.26100.8875 — SHA256 `b2c0de4ced045cada8953b4524a198792c5f686f2f83cf295164171a3efd487e` |
| **Feature flag** | `Feature_4078681401` — **the fix is CFR-gated** |
| **Exploitability** | Exploitation Less Likely; not publicly disclosed; not exploited (per MSRC) |

---

## Product Description

`cimfs.sys` is the **Composite Image File System** driver, which mounts `.cim`
composite images as volumes (used by MSIX packaging, containers, and related
features). A directory listing on a mounted CIM volume issues an
`IRP_MJ_DIRECTORY_CONTROL` query, handled by
`CimFs::DispatchVolumeDirectoryControl`, which drives an internal
**directory-query object/cursor** (`CimFs::DirectoryQueryCursor`) to walk the
composite image's directory entries and return `FILE_*_DIRECTORY_INFORMATION`
metadata (names, sizes, timestamps, attributes) to the caller.

---

## Vulnerability Summary

Pre-patch, `DispatchVolumeDirectoryControl` consumed that internal directory-query
object **without validating its type**. On a crafted or unexpected-state CIM
volume, an object of a **different type** could be reached and then interpreted as
the expected directory-query structure, so its fields were read at the wrong
offsets/types — a type confusion (CWE-843). The result is that incorrect / adjacent
object memory is formatted into the returned directory information, disclosing
**file metadata** the caller should not see. The handler runs in the kernel and the
query is reachable by a local user who mounts/queries a CIM volume, so this is a
local information-disclosure primitive (no integrity/availability impact,
consistent with `C:H/I:N/A:N`).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): mount and issue a directory query
  against a crafted composite image (`.cim`) volume.
- Drive the query so the directory-query object reached by the handler is not the
  expected type.
- Result: mis-typed object fields are returned as directory metadata.

---

## Vulnerability Details

### Root Cause

The directory-query object backing the enumeration was used by
`DispatchVolumeDirectoryControl` without a type/validity check, so a differently
typed object could be interpreted as the directory-query structure and its memory
read at the wrong offsets.

### The patch (confirmed — diff, .8737 → .8875)

Gated behind `Feature_4078681401`, `CimFs::DispatchVolumeDirectoryControl` now
**validates the object's type/validity before using it** — checking a type magic and
a flag bit and branching away when they don't match:

```c
// CimFs::DispatchVolumeDirectoryControl (10.0.26100.8875) — PATCHED (from our diff)
if (psVar4 != NULL && *psVar4 == 0x5452) {                 // type magic check
    if (Feature_4078681401__private_IsEnabledDeviceUsageNoInline()
        && ((*(uint *)(psVar4 + 0xe8) & 0x10) == 0)) {     // required type/flag bit not set
        goto reject;                                       // do not consume as directory-query object
    }
    // ... proceed only for a validated object ...
}
```

With the object's type magic (`0x5452`) and flag bit (`+0xe8 & 0x10`) verified
before it is consumed, a mis-typed object is no longer read as the directory-query
structure, closing the type confusion and the metadata leak.

> `DispatchVolumeDirectoryControl` is confirmed code-changed under
> `Feature_4078681401` with the added type/flag validation; the precise field
> semantics (the `0x5452` magic and the `+0xe8` flag bit) are stated at
> confirmed-changed level from the decompiled diff.

### Patch Completeness Assessment

**CFR-gated behind `Feature_4078681401`.** The type validation runs only when the
flag is enabled; the original unchecked path still ships when disabled. Verify
`Feature_4078681401` is enabled to confirm the fix is live.

---

## Detection Guidance

**Behavioural.** Directory-control queries against mounted composite image (`.cim`)
volumes, especially crafted/unusual CIM images; type-confusion / anomalous
directory-metadata results or crashes in
`cimfs!CimFs::DispatchVolumeDirectoryControl` on unpatched/flag-disabled builds.

**Config.** The fix is CFR-gated — confirm `Feature_4078681401` is enabled.

---

## References

- MSRC advisory — CVE-2026-50381 (Composite Image File System Driver Information Disclosure), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/cimfs_sys-cve-2026-50381-ghidriff.md`