Windows NTFS CVE-2026-50309

Exploitation requires the attacker to already hold authenticated low-privileged local access to the target host (CVSS PR:L, AV:L) and the ability to execute code or issue file-system operations against an NTFS volume - the near-universal default file system on Windows. There is no remote attack surface and no user interaction is needed (UI:N). The limiting factor is the local-access prerequisite: an attacker must first land on the machine as some local user before triggering the heap overflow in the NTFS driver; there is no indication of a non-default configuration requirement, so default NTFS-formatted Windows installations across the listed client and server versions are exposed once local access is achieved.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) describes a locally exploitable flaw of low attack complexity requiring low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact within an unchanged scope - a classic local elevation-of-privilege profile rather than a remote-entry vulnerability. No EPSS score, KEV listing, SSVC decision, or POC signal is present in the provided data, so exploitation is currently no public exploit identified at time of analysis and there is no evidence of active exploitation. Real-world priority is moderate-to-high: the affected component (NTFS) is ubiquitous and the low-privilege prerequisite is easily met by any local user or already-landed malware seeking SYSTEM, but the local-only attack vector means this is a second-stage escalation tool, not an initial-access vector. The absence of EPSS/KEV data means widespread automated exploitation cannot be confirmed or ruled out - treat as a standard high-priority Patch-Tuesday elevation-of-privilege fix.

An attacker who has already obtained low-privileged local access - via phishing, a compromised service account, or a foothold from another bug - runs a program that issues crafted file-system operations against an NTFS volume to overflow a heap buffer in the kernel NTFS driver. The resulting pool corruption is groomed into arbitrary kernel-mode code execution, elevating the attacker to SYSTEM. No public exploit is identified at time of analysis, and the low complexity (AC:L) with no user interaction (UI:N) makes reliable weaponization plausible once code exists.