Windows NTFS CVE-2026-45636

Exploitation requires local attack vector (AV:L) plus user interaction (UI:R), meaning the attacker must deliver a malformed NTFS structure - most plausibly a VHD/VHDX disk image, ISO, or removable storage device - and induce a user on the target system to open, mount, or otherwise cause the NTFS driver to parse it. PR:N means no prior authentication on the target is required, so the victim user does not need to be an administrator. Limiting factors: the attack cannot be launched purely remotely over the network, the user must take an action against the malicious content, and the specific malformation must reach the vulnerable parsing path in ntfs.sys; the exact affected Windows builds are not enumerated in the provided data and must be confirmed against the MSRC advisory.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a local-vector vulnerability requiring user interaction but no privileges - typical of file-parsing flaws triggered when a user opens or mounts a malicious file/volume. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data was supplied, so signals point to a real but not yet weaponized issue. The PR:N + UI:R combination is notable: an unauthenticated attacker can succeed if they can persuade a user to interact with crafted content, which is realistic via phishing or removable media. Key data gaps: no EPSS score, no KEV status, no POC indicator, and no exact patched build list were provided - defenders should consult MSRC directly to confirm affected SKUs and patch KBs before prioritizing.

An attacker crafts a malicious NTFS volume - for example, a VHD/VHDX disk image or USB drive containing a malformed file system structure - and delivers it via phishing email, drive-by download, or physical access. When the victim opens or mounts the file, the NTFS driver parses the attacker-controlled metadata, triggering the heap overflow inside ntfs.sys and allowing code execution; because the parser runs in kernel mode, successful exploitation typically yields SYSTEM-level privileges. No public exploit identified at time of analysis, but the pattern is well understood from prior NTFS parsing CVEs.