EUVD-2026-43910
GHSA-pfrf-837w-gw49
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local access with mandatory user interaction to open/mount crafted NTFS content (AV:L/UI:R), no prior privileges (PR:N), and code execution yields high C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in the Microsoft Windows NTFS driver stems from an out-of-bounds read (CWE-125) that an attacker can leverage to run arbitrary code on affected systems, spanning Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025. Exploitation requires local access and user interaction (AV:L/UI:R), typically opening or mounting a maliciously crafted file or volume, but no prior authentication (PR:N). Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
NTFS (New Technology File System) is the default on-disk filesystem for Windows, implemented in the kernel-mode driver ntfs.sys which parses complex on-disk metadata structures (MFT records, index buffers, attribute lists) whenever a volume or file is accessed. The vulnerability is an out-of-bounds read (CWE-125): the driver reads memory outside the bounds of an allocated buffer, most likely due to trusting an attacker-controlled length or offset field within crafted filesystem metadata. While a classic OOB read yields information disclosure, Microsoft's tags also flag this as a Buffer Overflow, and the CVSS impact set (C:H/I:H/A:H) indicates the memory-safety defect is exploitable for code execution in a kernel/privileged context, likely by using the read primitive to defeat mitigations or corrupt adjacent state. The CPE data confirms the flaw is in the OS platform itself rather than an application, affecting a broad range of client and server SKUs.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50388 for your specific Windows SKU as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50388 (consult the Security Update Guide for the exact KB and patched build number for each affected version, as they differ across Windows 10, Windows 11, and Server 2012-2025). Because exploitation depends on a victim opening or mounting malicious filesystem content, effective compensating controls until patching include restricting the mounting of untrusted removable media and disk images (disable auto-mount/AutoPlay via Group Policy, which prevents automatic parsing of inserted volumes but inconveniences legitimate media use), blocking or scanning inbound .vhd/.vhdx/.iso and archive files at mail and web gateways, and limiting interactive/local logon on shared and multi-user hosts to reduce the population of potential victims. Ensure endpoint protection with kernel exploit-mitigation is enabled; note these controls reduce but do not eliminate exposure, so patching remains the primary fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today