CVE-2026-78451

Published: Sep 8, 2026Modified: Sep 11, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: secure@microsoft.com (Secondary)

Description

Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack.

Affected (19)

Products: Microsoft: Windows 10 1809, Windows 10 21h2, Windows 10 22h2, Windows 11 23h2, Windows 11 24h2, Windows 11 25h2, Windows 11 26h1, Windows Server 2019, Windows Server 2022, Windows Server 2025

10 products

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 10 1809	version < 10.0.17763.9245
Microsoft Windows 10 1809	version < 10.0.17763.9245
Microsoft Windows 10 21h2	version < 10.0.19044.7725
Microsoft Windows 10 21h2	version < 10.0.19044.7725
Microsoft Windows 10 21h2	version < 10.0.19044.7725
Microsoft Windows 10 22h2	version < 10.0.19045.7725
Microsoft Windows 10 22h2	version < 10.0.19045.7725
Microsoft Windows 10 22h2	version < 10.0.19045.7725
Microsoft Windows 11 23h2	version < 10.0.22631.7582
Microsoft Windows 11 23h2	version < 10.0.22631.7582
Microsoft Windows 11 24h2	version < 10.0.26100.9445
Microsoft Windows 11 24h2	version < 10.0.26100.9445
Microsoft Windows 11 25h2	version < 10.0.26200.9445
Microsoft Windows 11 25h2	version < 10.0.26200.9445
Microsoft Windows 11 26h1	version < 10.0.28000.2954
Microsoft Windows 11 26h1	version < 10.0.28000.2954
Microsoft Windows Server 2019	version < 10.0.17763.9245
Microsoft Windows Server 2022	version < 10.0.20348.5622
Microsoft Windows Server 2025	version < 10.0.26100.33438

Related CWEs

CWE-822

Untrusted Pointer Dereference

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78451

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.