Windows NTFS CVE-2026-50308

Exploitation requires the victim to interact with attacker-supplied content (CVSS UI:R): the attacker must get a user to open or mount a crafted NTFS-formatted artifact - a malicious volume, VHD/ISO disk image, or file - so that the vulnerable ntfs.sys parsing path processes the malformed metadata that triggers the CWE-191 integer underflow. The vector is local (AV:L), so the malicious content must reach the target host, but no prior authentication or elevated privileges are needed (PR:N). Limiting factors that reduce real-world risk: mandatory user interaction, the need to deliver the file/volume to the endpoint, and the absence of remote/network reachability; there is no indication of active exploitation (not in KEV) and no known POC, which further constrains near-term likelihood.

The CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a local attack vector with low complexity, no privileges required, but mandatory user interaction, and full high impact to confidentiality, integrity, and availability. The unusual PR:N combined with UI:R and AV:L is consistent with a file/volume-parsing bug: the attacker needs no prior authentication but must convince a user to open or mount malicious content. Signal cross-check: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC is indicated - so this is a serious-but-not-emergency patch priority rather than an actively-exploited crisis. One data conflict must be flagged: the input tags include 'Authentication Bypass,' which is inconsistent with the described integer-underflow local code-execution primitive and the CVSS impact metrics; treat that tag as likely mislabeled and rely on the description and CWE-191. Given NTFS is ubiquitous, the broad version matrix makes patch rollout worthwhile despite the local vector.

An attacker crafts a malicious NTFS artifact - such as a VHD/ISO or removable-volume image with a corrupted metadata field that triggers the integer underflow - and delivers it via email, download, or a USB drop. When the victim opens or mounts the artifact, the NTFS driver parses the malformed structure and the memory corruption allows attacker code to run locally. No public exploit is identified at time of analysis, and successful exploitation depends on the user interaction required by the CVSS vector.