Untrusted Pointer Dereference in Windows Server - CVE-2026-108416
Published: November 10, 2026
Vulnerability identifier: #VU164717
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108416
CWE-ID: CWE-822
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to system to escalate privileges to SYSTEM.
The vulnerability exists due to untrusted pointer dereference in Windows File Server Resource Management Service when handling untrusted pointer values. An attacker with physical access to system can exploit this pointer-handling flaw through physical access to the system to gain SYSTEM privileges.
Affected software
Windows Server
How to mitigate CVE-2026-108416
Install security update from vendor's website.
Windows Server - addressed in versions 2016 10.0.14393.9688, 2019 10.0.17763.9487, 2022 10.0.20348.5870, 2025 10.0.26100.33730, 2025 10.0.26100.33822