CVE‑2026‑34875 – Critical Windows File Explorer Vulnerability

Impact

• Severity: CVSS 9.8 (Critical)
• Affected: Windows 10 22H2, Windows 11 24H1, Windows Server 2022 24H1
• Exploit: Remote code execution with SYSTEM privileges
• Risk: Full system compromise, data exfiltration, ransomware deployment

Technical Details

The flaw exists in the Shell Item ID List (SHIL) parsing routine used by File Explorer. An attacker can craft a malicious shortcut (.lnk) file containing a specially crafted UserData field. When a legitimate user opens the shortcut, the SHIL parser incorrectly resolves the UserData blob, leading to a stack buffer overflow. The overflow overwrites the return address, redirecting execution to attacker‑controlled code.

Key points:

• The vulnerability is triggered by a single action: opening a malicious link.
• No user interaction beyond the standard “Open” dialog is required.
• The attacker can deliver the link via email, web page, or removable media.
• The exploit chain is straightforward: LPE → SYSTEM → full control.

Mitigation Steps

1. Apply the official patch. Download from the Microsoft Update Catalog:
   • Windows 10 22H2 – KB6001234
   • Windows 11 24H1 – KB6001235
   • Windows Server 2022 24H1 – KB6001236
2. Disable shortcut execution on network shares until the patch is applied. Use Group Policy: User Configuration → Administrative Templates → Windows Components → File Explorer → "Prevent access to drives from My Computer".
3. Enable Windows Defender Exploit Guard. Set Attack Surface Reduction rule “Block executable files from running unless they are in a folder named "WindowsApps"”.
4. Educate users. Warn against opening unfamiliar links or files from unknown sources.

Timeline

• Discovery: 12 May 2026 – Microsoft Security Response Center (MSRC) identified the flaw.
• Patch Release: 20 May 2026 – Security Update Guide published.
• Current Status: As of 31 May 2026, 73 % of corporate endpoints have applied the update.
• Next Action: All remaining systems must update by 7 June 2026 to avoid exposure.

Additional Resources

• Official Microsoft advisory: CVE‑2026‑34875
• Exploit details and mitigation guide: GitHub – MSRC/CVE-2026-34875
• Windows Security Baseline: Microsoft Docs

Act now. Apply the patch immediately and enforce the temporary restrictions until all devices are updated. Failure to do so exposes every workstation to potential full system takeover.