Windows NTFS CVE-2026-50341

The attacker must possess a valid local user account on the target system (CVSS PR:L) - this can be a standard, non-administrative account. Remote network-based exploitation is not possible (CVSS AV:L). No user interaction is required after the attacker initiates the malicious NTFS operation (UI:N). The NTFS file system driver must be active on the system, which is the default and virtually universal configuration on all affected Windows versions - no special non-default configuration is required. The attack is non-automatable per SSVC, meaning it cannot be reliably scripted for mass exploitation without individual interactive local access. Limiting factors: a pre-existing local account is mandatory; the vulnerability yields information disclosure only - no privilege escalation or code execution is achieved; and legacy Windows Server 2012/2012 R2 targets may already be operating past end-of-extended-support, affecting patch applicability.

The CVSS 3.1 base score of 5.5 (Medium) accurately captures the constrained attack surface: AV:L precludes remote exploitation, PR:L requires an existing account, and there is no integrity or availability dimension. The C:H rating reflects that kernel memory disclosure can be severe in quality even if the quantity read per operation is bounded. Against these signals, the EPSS score of 0.31% at the 22nd percentile indicates very low near-term exploitation probability relative to the broader vulnerability population. SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial - all pointing toward a low-urgency finding. There is no CISA KEV listing. No public exploit has been identified at time of analysis. The realistic threat model is an insider or a post-compromise attacker leveraging this flaw to harvest kernel-resident secrets (e.g., credential material, cryptographic keys) after already obtaining a local foothold. Defenders should not conflate the C:H metric with immediate external threat; patching is warranted on normal cadence, not emergency deployment.

A threat actor who has already compromised a low-privileged local account - via phishing, credential stuffing, or lateral movement - crafts a specially structured NTFS operation designed to trigger the buffer over-read in the kernel driver. The resulting out-of-bounds read leaks adjacent kernel memory, which the attacker processes locally to extract sensitive contents such as cached credentials or cryptographic material held in kernel address space. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) implies the trigger condition does not require precise memory layout manipulation.