Windows NTFS CVE-2026-49789

Exploitation requires the attacker to already be authenticated and able to execute code locally on the target Windows system (CVSS PR:L, AV:L), then trigger the vulnerable NTFS metadata-handling path - for example by presenting a crafted volume/filesystem structure or invoking the affected driver operation. No user interaction is required (UI:N) and no special non-default configuration is called out: the defect is in the core NTFS driver present in default Windows installations across the listed builds. The limiting factors are that this is not remotely reachable (local vector only), needs a pre-existing low-privileged account or code-execution foothold, and CISA SSVC rates it not automatable, so it cannot be trivially wormed or mass-exploited.

The signals are internally consistent and point to a genuine but non-urgent risk. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, base 7.8) describes a local attacker with some existing privilege achieving total compromise, and CISA SSVC agrees: Technical Impact 'total', but Exploitation 'none' and Automatable 'no' - meaning no observed exploitation and no reliable mass-automation path, which fits a local EoP that requires code execution on the host first. EPSS of 0.34% (26th percentile) and the absence of a KEV listing reinforce low near-term exploitation likelihood. There is no conflicting data here: everything (local vector, low EPSS, SSVC 'none', not KEV) aligns to 'important but not actively exploited.' The main caveat is that NTFS EoP bugs are historically attractive as the second stage of a chain after initial access (e.g., paired with a phishing/RCE foothold), so the low EPSS reflects standalone exploitation odds, not the value to an attacker who is already on the box.

An attacker who already has a low-privileged foothold on a Windows host - for example a standard user account gained via phishing or a compromised service - invokes the vulnerable NTFS code path with crafted filesystem metadata to overflow a kernel stack buffer and elevate to SYSTEM. Given AV:L/AC:L/PR:L/UI:N, no user interaction and only low existing privileges are needed, though the attacker must first be able to run code locally; no public exploit identified at time of analysis.