Windows NTFS CVE-2026-49797

Exploitation requires local delivery of a crafted NTFS artifact and mandatory user interaction (CVSS UI:R): a user must open or mount the attacker-supplied file, disk image, or NTFS volume so the NTFS driver parses the malicious metadata. No prior authentication or privileges are needed on the attacker's side (PR:N), but the attack cannot be performed purely remotely or without a victim action, and it requires local vector access (AV:L). This limits realistic risk to scenarios where an attacker can get a user to interact with malicious NTFS content; there is no evidence of default-configuration remote exploitation.

The CVSS 3.1 score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges required, but user interaction is required, with high confidentiality, integrity, and availability impact and no scope change. This profile is a classic local elevation/code-execution primitive rather than a remotely wormable flaw: an attacker must already be able to deliver content to the target and rely on a user mounting or opening a malicious NTFS artifact. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation. Note a nuance: PR:N combined with UI:R implies the attacker needs no prior authentication but does need a user to act (e.g., open or mount a crafted volume/image) - the user interaction, local vector, and lack of any public exploit make this a patch-in-normal-cycle priority rather than an emergency, though the ubiquity of Windows and the kernel-level impact warrant timely patching.

An attacker crafts a malicious NTFS artifact - such as a specially formed disk image, VHD, or file with corrupted NTFS metadata - and delivers it to a victim by email, download, or removable media. When the user opens or mounts the artifact, the NTFS driver parses the malformed structures and triggers the heap overflow in kernel context, allowing the attacker's code to execute on the system. No public proof-of-concept exploit is identified at time of analysis.