Cyber Posture

CVE-2026-26176

High

Published: 14 April 2026

Published
14 April 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 15.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26176 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the heap-based buffer overflow vulnerability in csc.sys by identifying, reporting, and applying vendor patches in a timely manner.

prevent

Implements memory protection mechanisms such as DEP and ASLR that prevent successful exploitation of heap buffer overflows in kernel drivers like csc.sys.

prevent

Validates and restricts inputs to the csc.sys driver to prevent malformed data from triggering the heap-based buffer overflow.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Heap-based buffer overflow in kernel driver (csc.sys) with local attack vector and low privileges directly enables local privilege escalation via vulnerability exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally.

Deeper analysisAI

CVE-2026-26176 is a heap-based buffer overflow vulnerability, classified under CWE-122, in the Windows Client Side Caching driver (csc.sys). This issue affects Windows systems that utilize the csc.sys driver for client-side caching functionality. Published on 2026-04-14T18:16:53.003, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

The vulnerability can be exploited by an authorized local attacker possessing low privileges. Exploitation requires local access with low attack complexity and no user interaction. Successful exploitation enables the attacker to elevate privileges locally, achieving high impacts on confidentiality, integrity, and availability.

Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26176 provides details on the vulnerability, including available patches and mitigation guidance for affected systems.

Details

CWE(s)

Affected Products

microsoft
windows 10 1607
≤ 10.0.14393.9060 · ≤ 10.0.14393.9060
microsoft
windows 10 1809
≤ 10.0.17763.8644 · ≤ 10.0.17763.8644
microsoft
windows 10 21h2
≤ 10.0.19044.7184 · ≤ 10.0.19044.7184 · ≤ 10.0.19044.7184
microsoft
windows 10 22h2
≤ 10.0.19045.7184 · ≤ 10.0.19045.7184 · ≤ 10.0.19045.7184
microsoft
windows 11 23h2
≤ 10.0.22631.6936 · ≤ 10.0.22631.6936
microsoft
windows 11 24h2
≤ 10.0.26100.8246 · ≤ 10.0.26100.8246
microsoft
windows 11 25h2
≤ 10.0.26200.8246 · ≤ 10.0.26200.8246
microsoft
windows 11 26h1
≤ 10.0.28000.1836 · ≤ 10.0.28000.1836
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.9060
+4 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-26180Same product: Microsoft Windows 10 1607
CVE-2026-25188Same product: Microsoft Windows 10 1607
CVE-2026-20840Same product: Microsoft Windows 10 1607
CVE-2026-20922Same product: Microsoft Windows 10 1607
CVE-2026-20820Same product: Microsoft Windows 10 1607
CVE-2025-21418Same product: Microsoft Windows 10 1607
CVE-2025-21378Same product: Microsoft Windows 10 1607
CVE-2026-20864Same product: Microsoft Windows 10 1809
CVE-2025-24995Same product: Microsoft Windows 10 1607
CVE-2025-24067Same product: Microsoft Windows 10 1607

References