CVE-2026-83784 in Windows
Summary
by MITRE • 10/14/2026
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical flaw within the Microsoft Windows Encrypting File System, specifically related to how absolute paths are processed during file encryption operations. This issue stems from improper validation of path inputs when interacting with EFS APIs or underlying system components that handle encrypted data storage and retrieval. An attacker who has already obtained authorized access to the target system can exploit this logic error by supplying a crafted absolute path string rather than a relative one. The operating system fails to correctly restrict the scope of the file operation, allowing the process to traverse outside the intended directory boundaries or manipulate files in locations that should be protected from such direct manipulation via EFS mechanisms.
From a technical perspective, this is classified as an Absolute Path Traversal vulnerability, which aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core issue lies in the failure to canonicalize or strictly validate file paths before passing them to sensitive cryptographic subsystems. When EFS processes these requests, it may resolve symbolic links or follow directory structures without sufficient checks against privilege boundaries. This allows an authenticated user to influence which files are encrypted, decrypted, or accessed using their own keys, potentially bypassing access controls that rely on the assumption that file operations remain confined to specific secure directories.
The operational impact of this vulnerability is significant because it facilitates Privilege Escalation over a network, corresponding to MITRE ATT&CK technique T1068: Exploitation for Privilege Escalation. Although the attacker requires initial authorized access, often through valid credentials or compromised accounts, the ability to manipulate EFS operations can lead to unauthorized reading of encrypted files belonging to other users or system services if key management is improperly isolated. Furthermore, by forcing encryption on specific system-critical files using weak or controlled keys, an attacker could potentially cause denial-of-service conditions or interfere with system integrity checks that rely on file states remaining unchanged and protected under standard administrative privileges.
Mitigation strategies primarily involve applying the latest security patches provided by Microsoft for the affected Windows versions, as this type of logic flaw is typically addressed through code hardening in subsequent updates. Administrators should ensure that EFS policies are configured to restrict key storage locations and enforce strict access controls on encrypted directories. Additionally, implementing least-privilege principles for user accounts reduces the attack surface, ensuring that even if an attacker gains initial access, they lack the necessary permissions to interact with sensitive cryptographic subsystems in a way that exploits path traversal logic. Regular auditing of file system activities and monitoring for unusual encryption operations can also aid in early detection of such exploitation attempts.