CVE-2026-57091 — Windows File History Service Elevation of Privilege Vulnerability
Executive Summary
Stack-based buffer overflow in Windows File History Service allows an authorized attacker to elevate privileges locally.
Overview
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EPSS Score
Affected Products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 1607 for 32-bit Systems | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1607 for x64-based Systems | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1809 for 32-bit Systems | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 1809 for x64-based Systems | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 21H2 for x64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for 32-bit Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for ARM64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 10 Version 22H2 for x64-based Systems | 5099539 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 24H2 for x64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 25H2 for x64-based Systems | 5101650 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | 5101649 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows 11 version 26H1 for x64-based Systems | 5101649 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2016 | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2016 (Server Core installation) | 5099535 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2019 (Server Core installation) | 5099538 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2022 | 5099540 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 | 5099536 (Security Update) |
Important | Elevation of Privilege | Yes |
| Windows Server 2025 (Server Core installation) | 5099536 (Security Update) |
Important | Elevation of Privilege | Yes |
Patches
| Article | Type | Restart |
|---|---|---|
5099535 |
Security Update | Yes |
5099538 |
Security Update | Yes |
5099539 |
Security Update | Yes |
5101650 |
Security Update | Yes |
5101649 |
Security Update | Yes |
5099540 |
Security Update | Yes |
5099536 |
Security Update | Yes |
Patch Diff
Stack-based buffer overflow (CWE-121) in the Windows File History Service fhsvc.dll AllocSessionProperties, local EoP to SYSTEM. AllocSessionProperties builds a session-properties structure containing a fixed 0x104-WCHAR (MAX_PATH) name/path field at offset +0x280 and copies a source string (param_1) into it. PRE: the copy was an inline loop that decremented a 0x104 counter but whose only effective termination was the source NUL (the length break tested a bogus sentinel -0x7ffffefa), so it copied the entire source string regardless of the 0x104 destination size - an overlong string overflows the fixed buffer (CWE-121). Because fhsvc runs as SYSTEM and the property string is attacker-influenced via the File History interface, the overflow is a local EoP-to-SYSTEM primitive (MSRC rates exploitation More Likely). Diff of fhsvc.dll 10.0.26100.5074 -> .8875 (Jul 14 2026, KB5101650) confirms the fix: AllocSessionProperties now performs a bounded StringCchCopyW((ushort*)(dest+0x280), 0x104, param_1), which truncates/null-terminates within the 0x104-WCHAR buffer, closing the overflow. Note: this binary is serviced infrequently, so the closest available pre-build is .5074 and the diff spans a wide range with unrelated WIL/ATL churn; the AllocSessionProperties bounded-copy is the isolated, confirmed CWE-121 fix and is a direct hardening (not CFR-gated; Feature_2475400507 in this update gates unrelated changes).
| Function | Address | Change | Note |
|---|---|---|---|
AllocSessionProperties |
code change |
code (unbounded copy replaced with bounded StringCchCopyW) | Pre: inline copy of param_1 into the 0x104-WCHAR field at dest+0x280 whose loop only stopped on the source NUL (length break tested sentinel -0x7ffffefa) -> overflows the fixed buffer. Post: StringCchCopyW((ushort*)(dest+0x280), 0x104, param_1) bounds the copy to 0x104 WCHARs. |
Attack Path
A session-property string is copied into a fixed 0x104 buffer without a real length bound, overflowing it in the SYSTEM File History service
Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.