EUVD-2026-43873
GHSA-8943-r5m9-8c43
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local NTFS driver flaw requires an existing low-privileged account (AV:L, PR:L); pure memory disclosure yields C:H with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally.
AnalysisAI
Buffer over-read in the Windows NTFS kernel driver exposes adjacent memory contents to a local attacker holding a standard user account across a broad range of Windows 10, 11, and Server releases. Exploitation is constrained to AV:L/PR:L, meaning an attacker must already have interactive or programmatic local access before triggering the CWE-126 condition - making this a post-compromise reconnaissance primitive rather than an initial-access vector. EPSS stands at 0.31% (22nd percentile) and SSVC confirms no known exploitation activity, placing this at low operational urgency despite the High confidentiality impact rating.
Technical ContextAI
CWE-126 (Buffer Over-Read) describes a condition where a program reads data beyond the allocated boundary of a buffer, potentially exposing adjacent memory to the caller. The flaw resides in the Windows NTFS (New Technology File System) kernel-mode driver - the default and nearly universal file system handler on all supported Windows versions. A crafted NTFS structure or file system request causes the driver to read past the intended buffer boundary, leaking kernel or adjacent process memory contents. CPE data confirms affected product families include Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server (2012, 2012 R2, 2016, 2019, 2022, and 2025), covering essentially the entire supported and some legacy Windows fleet. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a locally triggered, low-complexity condition with no integrity or availability impact - consistent with a pure information-disclosure class of kernel driver flaw.
RemediationAI
Apply the vendor-released patch via Windows Update or WSUS as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50341. Fixed build targets confirmed by EUVD include: Windows 11 24H2/25H2 at 10.0.26100.8875 and 10.0.26200.8875 respectively, Windows 11 26H1 at 10.0.28000.2525, Windows Server 2025 at 10.0.26100.33158, Windows Server 2022 at 10.0.20348.5386, Windows Server 2016 and Windows 10 1607 at 10.0.14393.9339, Windows Server 2019 and Windows 10 1809 at 10.0.17763.9020, Windows 10 21H2 at 10.0.19044.7548, Windows 10 22H2 at 10.0.19045.7548, Windows Server 2012 at 6.2.9200.26226, and Windows Server 2012 R2 at 6.3.9600.23291. If immediate patching is not feasible, restrict local interactive logon rights (via Local Security Policy or Group Policy) to only operationally required accounts, reducing the pool of potential exploiters. For server environments, enforce just-in-time privileged access and remove standing local user sessions. NTFS itself cannot be disabled without breaking system functionality, so patching is the only definitive remediation.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today