Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local, low-complexity parsing bug needing no privileges but requiring the victim to open/mount crafted content (UI:R), yielding full kernel-level code execution (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in the Windows NTFS file system driver lets an unauthorized attacker run arbitrary code by tricking a user into interacting with specially crafted content, per Microsoft's MSRC advisory. The flaw is a heap-based buffer overflow (CWE-122) affecting a broad range of Windows releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and full-CIA impact make it a meaningful local code-execution risk.
Technical ContextAI
NTFS is the default file system driver on all supported Windows editions, running in kernel context and parsing on-disk metadata whenever volumes, images, or files are mounted or accessed. CWE-122 (heap-based buffer overflow) indicates that malformed NTFS structures - for example a crafted disk image, VHD/VHDX, or file with inconsistent length/size fields - cause the driver to write past an allocated heap buffer, corrupting adjacent kernel heap memory. The affected CPE set spans Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), marking this a core-OS defect rather than an application-level bug.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-50386 via Windows Update or WSUS/SCCM to all affected client and server SKUs, prioritizing the correct KB for each Windows build listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50386 (an exact fixed version is not enumerated in the provided data, so verify the KB per OS build). Because exploitation requires a user to open or mount attacker-supplied content, useful compensating controls until patching completes include blocking untrusted disk images and file attachments at the mail/web gateway, disabling or restricting automatic mounting of removable media and VHD/VHDX/ISO files, and enforcing least privilege so kernel corruption yields less lateral value; note these controls reduce convenience (loss of auto-mount for legitimate images) and are stopgaps rather than substitutes for the update.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-43862
GHSA-9xqj-ppwh-278r