Windows NTFS CVE-2026-50313

Exploitation requires local delivery of a maliciously crafted NTFS artifact - a file or a specially formed NTFS volume/disk image - that is then parsed by the Windows NTFS driver, and it requires user interaction (CVSS UI:R): the victim must open the file or trigger the mount/access of the crafted volume. It does not require the attacker to hold prior privileges on the target (PR:N) and the attack vector is local, not network (AV:L), so remote unauthenticated triggering against a default configuration is not supported by the data. Limiting factors that reduce real-world risk: the need for user interaction, the requirement that the victim system actually mount or open the attacker's crafted NTFS data, and the absence of any public exploit or KEV listing at time of analysis.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8, High) indicates a local attack vector with low complexity, no prior privileges, but required user interaction - consistent with a scenario where a victim must open or mount a maliciously crafted file or volume rather than a fully remote drive-by. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced, so this is not a validated widespread-exploitation event today. However, NTFS is present in essentially every Windows deployment, giving the flaw an enormous attack surface, and PR:N combined with high triple-impact means a successful trigger yields full compromise of the affected context. Note a nuance to verify with the vendor: PR:N (no privileges) together with UI:R and a heap overflow in the kernel file-system driver is typical of the file-parsing exploitation model - the 'no privileges' reflects that any user who is induced to open a crafted artifact can trigger it, not that it is remotely reachable. No SSVC decision data was provided, so automatability and exploitation-status fields cannot be independently assessed.

An attacker crafts a malicious file or a specially structured disk image/volume and delivers it to a victim via email, download, or removable media; when the user opens the file or the volume is mounted, the NTFS driver parses the malformed metadata and overflows a heap buffer in kernel memory, allowing the attacker to execute code in the exploited context. No public exploit is identified at time of analysis, and the CVSS UI:R requirement means the victim must be induced to interact with the crafted artifact.