Untrusted Pointer Dereference in Windows Server - CVE-2026-108415
Published: November 10, 2026
Vulnerability identifier: #VU164716
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108415
CWE-ID: CWE-822
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to system to escalate privileges to SYSTEM.
The vulnerability exists due to untrusted pointer dereference in Windows File Server Resource Management Service when the service accesses memory through an untrusted pointer. An attacker with physical access to system can exploit this pointer-handling flaw through physical access to gain SYSTEM privileges.
Affected software
Windows Server
How to mitigate CVE-2026-108415
Install security update from vendor's website.
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822