Windows NTFS CVE-2026-50386

Exploitation requires local delivery of specially crafted NTFS content and a user action to process it: per the CVSS vector (AV:L, UI:R), the victim must open, access, or mount an attacker-supplied file or disk image (such as a crafted VHD/VHDX, ISO, or NTFS volume) so the NTFS driver parses the malformed structures. No prior authentication or privileges are needed (PR:N) and attack complexity is low (AC:L). The key limiting factors are the mandatory user interaction and the local vector - there is no remote or unauthenticated network path and no autonomous/wormable exploitation; the affected feature is the built-in NTFS file system parser present by default on all listed Windows client and server versions.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges required but user interaction required, with high confidentiality, integrity and availability impact. The AV:L plus UI:R combination means the flaw cannot be exploited remotely or fully autonomously: a victim must open or mount attacker-supplied content, which lowers real-world exploitability versus a network-facing bug. It is not in CISA KEV, and no EPSS score or public POC was provided, so there is no evidence of active or automatable exploitation; risk is currently serious-but-theoretical rather than a confirmed in-the-wild priority. The main escalating factor is NTFS ubiquity and the breadth of affected versions, giving any future weaponized exploit a very large target surface.

An attacker emails or hosts a crafted NTFS disk image (for example a malicious VHDX or ISO) and lures a user into double-clicking or mounting it; when the NTFS driver parses the malformed metadata, the heap overflow corrupts kernel memory and executes attacker code. Given AV:L/AC:L, the technical bar is low once the file is opened, but success hinges entirely on that user interaction. No public exploit code is identified at time of analysis.