EUVD-2026-43864
GHSA-3jhf-6mfp-j33g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged user triggers a kernel NTFS heap overflow with no user interaction, gaining full SYSTEM code execution, hence AV:L/PR:L and C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows NTFS arises from a heap-based buffer overflow (CWE-122) that an authorized, low-privileged local user can trigger to run arbitrary code and elevate to SYSTEM. The flaw spans a broad Windows footprint from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit identified at time of analysis, and the CVSS 3.1 base score is 7.8 (High).
Technical ContextAI
NTFS is the default on-disk file system driver (ntfs.sys) shipped in the Windows kernel and mediates all metadata and data operations on NTFS volumes. CWE-122 (heap-based buffer overflow) indicates that attacker-influenced input - typically a crafted file, volume structure, or file-system control operation - causes a write past the bounds of a heap allocation inside the kernel-mode driver, corrupting adjacent pool memory. Because the vulnerable code runs in the kernel, controlled corruption can be steered into arbitrary code execution or a privilege escalation primitive. The CPE set enumerates Microsoft Windows client releases (10 1607/1809/21H2/22H2 and 11 24H2/25H2/26H1) and Windows Server releases (2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations), all of which ship this NTFS driver.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-50309 as documented in the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50309, selecting the KB that matches each affected build (Windows 10 1607-22H2, Windows 11 24H2-26H1, and Windows Server 2012 through 2025 including Server Core). No exact numeric fix version is provided in the input, so consult the MSRC page for the per-SKU patched build before deployment. Because exploitation requires local low-privileged access, interim compensating controls where patching must be delayed include restricting interactive and remote-desktop logon rights to trusted administrators (reduces the pool of local principals who can trigger the flaw, at the cost of operational access), enforcing application allow-listing to block untrusted binaries that would carry the elevation-of-privilege payload, and tightening access to shared or removable NTFS volumes handled by multiple users; none of these fully remove the vulnerability and should be treated only as stop-gaps until the update is installed.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today