Vulnerability · Published Apr 27, 2026 · Assigned by CSA
CVE-2026-3006Race Condition Vulnerability
High 7.0
In plain English
A high-severity race condition in WinFSP from WinFSP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to the affected software.
Affected products (as reported)
Weakness: CWE-362, CWE-368 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-043
- https://github.com/winfsp/winfsp/releases/tag/v2.2B1
- https://access.redhat.com/security/cve/CVE-2026-3006 vdb-entry, x_refsource_REDHAT
- RHBZ#2463150 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3006.json x_sadp-csaf-vex