WinFsp Vulnerability CVE-2026-3006 Requires Immediate Update
Summary
CSA has issued CVE ID CVE-2026-3006 to a vulnerability reported in WinFsp, an open-source system software. The vulnerability is a race condition affecting WinFsp versions 2.1.25156 and lower. Successful exploitation could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access. The Product Owner has released security update v2.2B1 to address it.
“Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to the affected software.”
Organizations running WinFsp on Windows systems should verify their installed version and update to v2.2B1 or later without delay. Given the kernel-level access possible through this race condition vulnerability, organizations should treat this as an urgent patching priority regardless of other scheduled update cycles.
About this source
The Cyber Security Agency of Singapore is the country's lead cybersecurity authority. Their alerts and advisories page publishes vulnerability notifications, active exploitation warnings, and remediation guidance with a focus on software widely used across ASEAN enterprise: financial services, telecoms, healthcare, government. Around 30 advisories a month, each with CVE references, severity, and patching steps. CSA tends to publish faster than CISA on vulnerabilities affecting Asian-headquartered vendors and is the authoritative voice for Singapore-licensed financial institutions under the MAS Technology Risk Management framework. Watch this if you run security in Asia-Pacific, advise MAS-regulated firms, or track regional CVE coverage. GovPing publishes each advisory with affected vendor, CVE, and original CSA link.
What changed
CSA issued a vulnerability disclosure (CVE-2026-3006) for WinFsp, an open-source system software. The vulnerability is a race condition affecting WinFsp versions 2.1.25156 and lower. Successful exploitation could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to affected software.\n\nOrganizations and administrators using WinFsp should immediately update to version 2.2B1 or the latest available version to mitigate the risk of local privilege escalation attacks.
What to do next
- Update to the latest version immediately
Archived snapshot
Apr 27, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Alerts
Vulnerability in Windows File System Proxy (WinFsp)
27 April 2026
CSA has issued a CVE ID to a vulnerability reported in WinFsp as part of CSA’s Responsible Vulnerability Disclosure Policy. Users and administrators of the affected product version are advised to update to the latest version immediately.
Background
CSA has issued a CVE ID (CVE-2026-3006) to a vulnerability reported in WinFsp, an open-source system software. The Product Owner of WinFsp has released a security update to address it.
Impact
Successful exploitation of the race condition vulnerability could allow an attacker to trigger a kernel heap overflow, potentially leading to local privilege escalation and granting system-level access to the affected software.
Affected Products
The vulnerability affects WinFsp versions 2.1.25156 and lower.
Mitigation
Users and administrators of affected product versions are advised to update to the latest version immediately.
Special Thanks to:
- Informer: Mr Tay Kiat Loong
- Product Owner: WinFsp References
Parties
Related changes
Get daily alerts for CSA Alerts & Advisories (Singapore)
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CSA.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CSA Alerts & Advisories (Singapore) publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.