EUVD-2026-35559
GHSA-6798-vf82-f698
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Windows NTFS allows an unauthorized attacker to run arbitrary code on the target system by triggering a heap-based buffer overflow, with no public exploit identified at time of analysis. The CVSS 7.8 rating reflects high impact across confidentiality, integrity, and availability, but exploitation requires local vector and user interaction. Microsoft (secure@microsoft.com) is the assigning CNA, indicating a first-party vendor advisory via MSRC.
Technical ContextAI
NTFS (New Technology File System) is the default file system driver for Windows, implemented in the kernel-mode ntfs.sys driver. CWE-20 (Improper Input Validation) is the assigned root cause class, manifesting here as a heap-based buffer overflow - meaning attacker-controlled input is not properly validated for size or structure before being written to a heap allocation, corrupting adjacent memory. Because NTFS parsing runs in kernel context, memory corruption in this code path is a classic vector for local privilege escalation and kernel code execution. No CPE strings were provided in the input, so the precise affected Windows builds must be retrieved from the MSRC advisory.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45636, which lists the exact KB numbers for each affected Windows SKU; exact fix build numbers were not included in the input data and must be retrieved from MSRC. Until the update is deployed, compensating controls include blocking the mounting of untrusted external volumes and disk images (group policy can restrict removable storage and disable automount of VHD/VHDX files, at the cost of blocking legitimate external drive use), restricting the ability of standard users to open arbitrary file attachments via attachment manager and Mark-of-the-Web enforcement, and monitoring endpoint telemetry for NTFS parser crashes and ntfs.sys faults that may indicate exploitation attempts. Avoid disabling NTFS itself, as it is the primary Windows file system and not a feasible workaround.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Elevation of privilege in the Windows Win32k kernel-mode driver allows a local, low-privileged attacker to escalate to S
Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today