Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CIRCL (temporal)
6.8 MEDIUM
cvss
vuln.today AI
7.8 HIGH

Local, low-complexity parsing bug needing no privileges but requiring the victim to open/mount crafted content (UI:R), yielding full kernel-level code execution (C/I/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 20:49 vuln.today
CVE Published
Jul 14, 2026 - 17:06 nvd
HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in the Windows NTFS file system driver lets an unauthorized attacker run arbitrary code by tricking a user into interacting with specially crafted content, per Microsoft's MSRC advisory. The flaw is a heap-based buffer overflow (CWE-122) affecting a broad range of Windows releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and full-CIA impact make it a meaningful local code-execution risk.

Technical ContextAI

NTFS is the default file system driver on all supported Windows editions, running in kernel context and parsing on-disk metadata whenever volumes, images, or files are mounted or accessed. CWE-122 (heap-based buffer overflow) indicates that malformed NTFS structures - for example a crafted disk image, VHD/VHDX, or file with inconsistent length/size fields - cause the driver to write past an allocated heap buffer, corrupting adjacent kernel heap memory. The affected CPE set spans Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core), marking this a core-OS defect rather than an application-level bug.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-50386 via Windows Update or WSUS/SCCM to all affected client and server SKUs, prioritizing the correct KB for each Windows build listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50386 (an exact fixed version is not enumerated in the provided data, so verify the KB per OS build). Because exploitation requires a user to open or mount attacker-supplied content, useful compensating controls until patching completes include blocking untrusted disk images and file attachments at the mail/web gateway, disabling or restricting automatic mounting of removable media and VHD/VHDX/ISO files, and enforcing least privilege so kernel corruption yields less lateral value; note these controls reduce convenience (loss of auto-mount for legitimate images) and are stopgaps rather than substitutes for the update.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-50386 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy