# CVE-2026-57091 — Windows File History Service `fhsvc.dll` Unbounded Copy in `AllocSessionProperties` → Stack-Based Buffer Overflow

---

## Summary

| | |
|---|---|
| **Product** | Windows — `fhsvc.dll` (File History Service, runs as SYSTEM) |
| **CVE ID** | CVE-2026-57091 |
| **Impact** | Elevation of Privilege (to SYSTEM) |
| **MSRC severity** | Important |
| **CVSS** | 7.8 / 6.8 — `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` |
| **CWE** | CWE-121: Stack-based Buffer Overflow |
| **Delivery** | Local — an overlong session-property string via the File History interface |
| **KB / Fixed build** | KB5101650 — `fhsvc.dll` 10.0.26100.8875 (Win11 24H2 x64) |
| **Patch Date** | July 14, 2026 (2026-Jul) |
| **Pre-patch binary (closest available)** | `fhsvc.dll` 10.0.26100.5074 — SHA256 `e607433d2075c4a3feb4ee2c6637a878de33b3eda5f026c3067469c1ec9fab3b` |
| **Post-patch binary** | `fhsvc.dll` 10.0.26100.8875 — SHA256 `21784a0e6189de885713959ce9878764c84acfc3d97c53b0fec2831d9da7f578` |
| **Feature flag** | none — direct fix (not CFR-gated) |
| **Exploitability** | Exploitation **More Likely**; not publicly disclosed; not exploited (per MSRC) |

> Sourcing note: `fhsvc.dll` is serviced infrequently, so the closest pre-fix build
> available is `.5074`; the diff therefore spans a wide range with unrelated
> WIL/ATL churn. The `AllocSessionProperties` bounded-copy below is the isolated,
> confirmed CWE-121 fix.

---

## Product Description

`fhsvc.dll` is the **Windows File History Service**, which runs as SYSTEM.
`AllocSessionProperties` builds a session-properties structure that contains a fixed
**`0x104`-WCHAR (MAX_PATH)** name/path field at offset `+0x280`, into which it copies
a source string (`param_1`).

---

## Vulnerability Summary

Pre-patch, the copy into the fixed `0x104`-WCHAR field was an inline loop that,
although it initialised a `0x104` counter, only actually terminated on the source
string's NUL — its length check tested a bogus sentinel (`-0x7ffffefa`) rather than
the counter reaching zero:

```c
// AllocSessionProperties (10.0.26100.5074) — PRE-PATCH (from our diff)
p_Var3 = p_Var1 + 0x280;
lVar5  = 0x104;
lVar4  = (longlong)param_1 - (longlong)p_Var3;
do {
    if ((lVar5 == -0x7ffffefa) || (*(short *)(p_Var3 + lVar4) == 0)) break;  // only NUL really stops it
    *(short *)p_Var3 = *(short *)(p_Var3 + lVar4);
    p_Var3 = p_Var3 + 2;
    lVar5  = lVar5 + -1;
} while (lVar5 != 0);
*(short *)p_Var2 = 0;
```

So a source string longer than `0x104` WCHARs is copied in full into the fixed
buffer, overflowing it (CWE-121). Because `fhsvc` runs as **SYSTEM** and the
property string is attacker-influenced through the File History interface, the
overflow is a local elevation-of-privilege primitive to SYSTEM (MSRC rates
exploitation **More Likely**).

---

## Prerequisites and Constraints

- Local, low-privileged (`PR:L`, `AV:L`, `AC:L`): reach `AllocSessionProperties`
  through the File History service and supply the property string.
- Provide a string longer than `0x104` WCHARs.
- Result: the fixed `+0x280` buffer overflows within the SYSTEM service.

---

## Vulnerability Details

### Root Cause

The copy into the fixed `0x104`-WCHAR session-property field enforced no effective
length limit (its bound check was a dead sentinel comparison), so it copied the
entire source string and overflowed the buffer.

### The patch (confirmed — diff, .5074 → .8875)

`AllocSessionProperties` now performs a **bounded** copy with `StringCchCopyW`,
capping the destination at `0x104` WCHARs and NUL-terminating within it:

```c
// AllocSessionProperties (10.0.26100.8875) — PATCHED (from our diff)
StringCchCopyW((ushort *)(p_Var1 + 0x280), 0x104, param_1);   // bounded to 0x104 WCHARs
```

With the copy bounded to the destination size, an overlong source string is
truncated instead of overflowing the buffer, closing the stack overflow. This is a
direct hardening and is not CFR-gated (the `Feature_2475400507` flag present in this
update gates unrelated changes in the wide-span rebuild).

### Patch Completeness Assessment

Fixed in `fhsvc.dll` 10.0.26100.8875 (July 2026). Apply KB5101650. The bounded copy
runs unconditionally (no feature flag to verify).

---

## Detection Guidance

**Behavioural.** File History service operations that supply overlong session
property / path strings (> 260 chars); stack-overflow / `__security_check_cookie`
bugchecks in `fhsvc!AllocSessionProperties` within the SYSTEM File History service
on unpatched builds.

---

## References

- MSRC advisory — CVE-2026-57091 (Windows File History Service Elevation of Privilege), released 2026-07-14, KB5101650.
- Full binary diff: `/data/patch_diffs/fhsvc_dll-cve-2026-57091-ghidriff.md`