Windows NTFS CVE-2026-50388

Exploitation requires the attacker to get a victim to locally access attacker-controlled NTFS content - the CVSS vector's UI:R and AV:L mean a user must open, browse, or mount a crafted file or volume (such as a malicious VHD/VHDX disk image, ISO, or removable drive) so that the vulnerable ntfs.sys parsing path is reached. No authentication or prior privileges are needed (PR:N) and complexity is low (AC:L), but the requirement for local access plus mandatory user interaction is the key limiting factor: this cannot be triggered remotely over the network and cannot be fully automated without a victim action. Affected default configurations span all listed Windows 10/11 and Server 2012-2025 builds, so no non-default feature toggle is required beyond the standard NTFS mounting/parsing behavior present out of the box.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - local attack vector, low complexity, no privileges required, but user interaction required. This is a classic local privilege-escalation/RCE profile: an attacker cannot reach it over the network, and it needs a victim to open or mount attacker-supplied content, which meaningfully limits mass exploitation. No EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept was reported, so all available evidence points to no confirmed exploitation to date. One notable tension: the description characterizes the flaw purely as an 'out-of-bounds read' (typically an information-disclosure primitive), yet the CVSS impacts and Microsoft's 'Buffer Overflow' tag assert full high confidentiality, integrity, and availability impact - verify the exact impact with Microsoft's advisory, as OOB reads are sometimes over-rated or must be chained. Overall this is a real but second-tier priority: patch it in the normal update cycle, prioritizing multi-user hosts, RDP/terminal servers, and systems that mount untrusted media.

An attacker crafts a malicious file or disk image (e.g., a VHD/VHDX or removable volume with corrupted NTFS metadata) and delivers it to a victim via email, download, or physical media. When the user opens or mounts the content, the NTFS driver parses the malformed structures, triggers the out-of-bounds read, and the attacker leverages the memory-safety defect to execute code in a privileged context. No proof-of-concept has been publicly identified at time of analysis, and success requires the specific user interaction of accessing the crafted content.