Urgent: CVE-2026-41673 – Critical Remote Code Execution in Windows 10/11

Immediate Impact

• CVE-2026-41673 exposes a remote code execution flaw in the Windows kernel.
• Affected systems: Windows 10 version 21H2 and later, Windows 11 version 22H2 and later.
• CVSS v3.1 score: 9.8 (Critical).
• Attackers can execute arbitrary code with SYSTEM privileges.
• Exploitation requires network reachability to the target.

Technical Details

The vulnerability resides in the handling of SCSI command buffers within the Windows Storage Driver Framework. When a malicious SCSI command is received, the driver fails to validate the buffer length before copying data into a fixed-size stack buffer. This oversight allows an attacker to overflow the buffer, overwrite the return address, and redirect execution to attacker‑supplied code.

The flaw is triggered by a specially crafted SCSI command sent over a network‑attached storage device or a virtualized storage interface. The kernel’s lack of bounds checking permits the buffer overflow without any user interaction. Once the stack is corrupted, the attacker gains full SYSTEM privileges.

Mitigation Steps

1. Check your system version – Run winver or systeminfo to confirm you are on Windows 10 21H2+ or Windows 11 22H2+.
2. Download the update – Visit the official Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide and locate KB5534567.
3. Install the patch – Run the downloaded installer or enable automatic updates.
4. Reboot – A restart is required for the kernel changes to take effect.
5. Verify installation – Use sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth to ensure system integrity.
6. Monitor for anomalous activity – Check Event Viewer for unexpected SYSTEM‑level processes.

Timeline

• Discovery – 10 April 2026, reported by an internal Microsoft security team.
• Public disclosure – 20 April 2026 via the Microsoft Security Response Center.
• Patch release – 5 May 2026 (KB5534567).
• Current advisory – 19 May 2026, urging immediate update.

Additional Resources

• Microsoft Security Update Guide: https://msrc.microsoft.com/update-guide
• Detailed advisory: https://msrc.microsoft.com/advisory/CVE-2026-41673
• Technical note on SCSI driver internals: https://docs.microsoft.com/en-us/windows-hardware/drivers/storage

Bottom Line

This is a critical flaw that can be leveraged by attackers with network access. Apply the KB5534567 update immediately and reboot. Failure to patch exposes your organization to high‑risk compromise.