A newly disclosed race-condition vulnerability in WinFsp (Windows File System Proxy), a widely used open-source framework that enables developers to create user-mode file systems on Windows, could allow local attackers to escalate privileges to SYSTEM.
The Cyber Security Agency of Singapore (CSA) assigned CVE-2026-3006 to the flaw as part of its Responsible Vulnerability Disclosure Policy, and the WinFsp project has already shipped a patched release.
WinFsp acts as a bridge between Windows and custom file system implementations, powering popular tools like SSHFS-Win, rclone mounts, and various cloud-storage clients that need to present remote or virtual storage as native Windows drives.
WinFsp Race Condition Flaw
Because it operates with kernel-level drivers to intercept file system calls, any flaw in its core logic carries outsized risk; a compromise here doesn’t just affect one application but potentially every file system built on top of it.
The vulnerability stems from a race condition in WinFsp’s kernel-mode driver. When exploited under the right timing conditions, an attacker can trigger a kernel heap overflow, corrupting memory in a way that can be leveraged to escalate privileges locally.
Successful exploitation grants the attacker SYSTEM-level access, the highest privilege tier on Windows, effectively handing over full control of the affected machine.
Race conditions like this are notoriously tricky to exploit reliably since they depend on precise timing between concurrent operations, but they’re equally difficult to fully rule out through code review alone, since the flawed logic only manifests under specific execution ordering.
CSA confirmed that once an attacker figures out a consistent trigger, though, the payoff (SYSTEM access) makes them a favored technique.
Affected Products
All WinFsp versions 2.1.25156 and earlier are vulnerable.
Mitigation
CSA and the WinFsp maintainers urge immediate upgrade to the patched release. The fix is available on GitHub.
Organizations and individual users running WinFsp-dependent tools should verify the installed driver version and apply the update as soon as possible, particularly on multi-user systems or endpoints where local access by lower-privileged users is a realistic threat.
Local privilege escalation bugs are frequently chained with initial access vulnerabilities in real-world attacks; a foothold gained through phishing or a web exploit can lead to full SYSTEM control once a flaw like this is exploited.
Given WinFsp’s popularity in developer and enterprise tooling for mounting cloud and remote storage, security teams should treat this patch with urgency and audit third-party software that bundles WinFsp components, as these may require separate updates beyond the core driver.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
, a widely used open-source framework that enables developers to create user-mode file systems on Windows, could allow local attackers to escalate privileges to the SYSTEM level.){kind=link}