What happened
A vulnerability has been identified in the Windows Portable Device MTP Driver, which can lead to a heap-based buffer overflow. This flaw permits an unauthorised attacker with physical access to potentially escalate privileges on affected devices. The vulnerability arises from inadequate handling of certain data within the driver, resulting in a high impact if exploited. The issue is characterised by a CVSS score of 6.8, indicating moderate severity, primarily due to requirements for physical access and no prior user interaction.
The flaw has been linked to specific versions of Microsoft Windows, including Windows 10 and Windows 11, along with several Windows Server editions. Notably, exploitation necessitates that the attacker has direct access to the device, with no prior foothold or network-based access needed. The attack exploits the driver’s processing of data on the device, requiring physical access to trigger the overflow. No updates or patches are currently available from the vendor at the time of reporting, underscoring the importance of physical security measures.
Who is affected
Organisations running Windows 10 Versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, and 26H1, are affected by this vulnerability. The impacted editions include both ARM64 and x64-based systems, as well as some Windows Server environments such as versions 2012, 2012 R2, 2016, 2019, and 2022. Any deployment that relies on these operating system versions and incorporates the Windows Portable Device MTP Driver could be susceptible if physically accessed by an unauthorised individual.
Recommended actions
Restrict physical access to affected devices to trusted personnel and secure hardware in controlled environments.
Implement strict device control policies to prevent unauthorised connection or tampering with hardware components.
Enhance endpoint monitoring and privilege hygiene practices to detect unusual physical access or attempts to exploit local vulnerabilities.
