CVE-2026-50381 — Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability
Executive Summary
Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 21H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 10 Version 21H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 10 Version 21H2 for x64-based Systems | 5099539 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 10 Version 22H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 10 Version 22H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 10 Version 22H2 for x64-based Systems | 5099539 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5101650 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5101650 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | 5101649 (Security Update) |
Important | Information Disclosure | Yes |
| Windows 11 version 26H1 for x64-based Systems | 5095051 (Security Update) |
Important | Information Disclosure | Yes |
| Windows Server 2022 | 5099540 (Security Update) |
Important | Information Disclosure | Yes |
| Windows Server 2025 | 5099536 (Security Update) |
Important | Information Disclosure | Yes |
| Windows Server 2025 (Server Core installation) | 5099536 (Security Update) |
Important | Information Disclosure | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5099539 |
Security Update | Yes |
5101650 |
Security Update | Yes |
5101649 |
Security Update | Yes |
5095051 |
Security Update | Yes |
5099540 |
Security Update | Yes |
5099536 |
Security Update | Yes |
Patch Diff
Type confusion (CWE-843) in the Windows Composite Image File System driver cimfs.sys directory-query path, local information disclosure of file metadata. cimfs.sys mounts composite image (.cim) volumes (used by MSIX / containers / WSA); a directory-control query (IRP_MJ_DIRECTORY_CONTROL) on a mounted CIM volume is handled by CimFs::DispatchVolumeDirectoryControl, which uses an internal directory-query object/cursor to walk the composite image's directory entries and return FILE_*_DIRECTORY_INFORMATION metadata to the caller. PRE: the handler consumed that internal object without validating its type tag, so on a crafted / unexpected-state CIM volume an object of a different type was interpreted as the expected directory-query structure, and its fields were read at the wrong offsets/types - a type confusion that returned incorrect file metadata (disclosing adjacent object/metadata contents) to a local caller. Diff of cimfs.sys 10.0.26100.8737 -> .8875 (Jul 14 2026, KB5101650) confirms the fix: gated behind CFR flag Feature_4078681401, CimFs::DispatchVolumeDirectoryControl now validates the object's type/validity before use - checking a type magic (*psVar4 == 0x5452) and a flag bit at offset 0xe8 ((flags & 0x10) == 0 branches away) - so a mis-typed object is no longer consumed as the directory-query structure, closing the type confusion. Note: DispatchVolumeDirectoryControl is confirmed code-changed under Feature_4078681401 with the added type/flag validation; the precise field semantics (0x5452 magic, +0xe8 flag) are stated at confirmed-changed level.
| Function | Address | Change | Note |
|---|---|---|---|
CimFs::DispatchVolumeDirectoryControl |
code change |
code (object type/validity validated before use, CFR-gated) | Pre: the internal directory-query object/cursor was used without a type check, so a different-typed object could be read as the directory-query structure -> type confusion leaking file metadata. Post (Feature_4078681401): validates a type magic (*psVar4 == 0x5452) and a flag bit at +0xe8 ((flags & 0x10)==0 -> branch away) before consuming the object. |
CimFs::NotifyChangeDirectory |
code change |
code (adjacent directory-notify path updated) | Directory-change notification path updated alongside the query handler under the same gate. |
Feature_4078681401 |
gate |
added (CFR gate) | CFR flag gating the object type/validity validation; the original unchecked path still ships when disabled. |
Attack Path
A directory query on a crafted CIM volume consumes an internal object without a type check, reading file metadata at the wrong type
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.