EUVD-2026-43869
GHSA-v7wh-hfv4-55rx
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file/volume parsing flaw needing victim interaction (AV:L, UI:R) but no prior privileges (PR:N); kernel-context overflow yields full C/I/A compromise.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows NTFS driver (heap-based buffer overflow, CWE-122) allows an attacker to run arbitrary code with the privileges of the exploited context. The flaw affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. CVSS 7.8 with high confidentiality, integrity, and availability impact; exploitation requires local access and user interaction, and there is no public exploit identified at time of analysis.
Technical ContextAI
NTFS (New Technology File System) is the default file system driver (ntfs.sys) that ships in the Windows kernel and parses on-disk metadata structures - MFT records, attributes, index buffers, and boot/volume structures - when a volume is mounted or a file is accessed. The vulnerability is classified as CWE-122 (Heap-Based Buffer Overflow), meaning the driver allocates a heap buffer and then writes past its bounds while processing attacker-controlled file-system data, corrupting adjacent kernel pool memory. Because NTFS parsing runs in kernel context, memory corruption here can be leveraged to hijack control flow. The CPE set confirms the affected component is the Microsoft Windows operating system across client SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025), including Server Core installations.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50313 for your specific Windows build via Windows Update or WSUS/Intune, using the per-KB fixed versions listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50313 (no single global fix version was provided in the source data, so select the KB matching each affected SKU). Because the vulnerability triggers through NTFS parsing of attacker-supplied files or volumes, effective compensating controls until patching completes are to block mounting of untrusted removable media and disk images (for example restrict or disable automatic mounting of VHD/VHDX and ISO files and USB mass-storage via device-control/Group Policy), and to enforce mark-of-the-web and attachment/download filtering so users cannot open crafted files delivered by email or web - with the trade-off that these controls can disrupt legitimate removable-media and disk-image workflows and require testing before broad rollout. Prioritize patching internet-facing and multi-user systems (RDS/Server Core) where untrusted files are most likely to be opened.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today