Windows NTFS CVE-2026-50412

Exploitation requires the attacker to already have local, authenticated access to the target Windows system with at least low-level privileges (CVSS PR:L), from which they execute code that interacts with the NTFS driver - there is no remote or network-triggerable path (AV:L) and no user interaction is needed (UI:N). The description does not name a specific non-default NTFS feature or configuration setting, indicating the standard, default NTFS file system present on every affected build is the required attack surface. The principal limiting factor is the local-access prerequisite: an attacker must first obtain a foothold (valid credentials, an existing session, or code execution) on the host before this flaw can be used, so it functions as a privilege-escalation link in a chain rather than an initial-access vector.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a local, low-complexity attack requiring only low existing privileges and no user interaction, yielding high confidentiality, integrity, and availability impact - the classic profile of a kernel local privilege escalation. Scope is Unchanged (S:U), meaning impact stays within the exploited security authority, but for a kernel driver that authority is effectively SYSTEM. No EPSS score, SSVC decision, POC, or KEV entry was supplied, so exploitation probability cannot be quantified from the data; the absence of a KEV listing means there is no confirmation of active exploitation. This is a genuine priority for privilege-escalation-in-depth (attackers routinely chain such local flaws after initial access), but the local-only attack vector and the requirement for a pre-existing foothold limit it below the urgency of a remote, unauthenticated bug. EPSS data is missing rather than low - do not interpret its absence as evidence of low risk.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through phishing, a compromised service account, or a standard user login on a shared/RDS server - runs a crafted program that drives NTFS into the vulnerable code path, overflowing a kernel stack buffer to execute code as SYSTEM. Given AV:L/AC:L/PR:L/UI:N, exploitation is local, low-complexity, requires only minimal existing privileges, and needs no user interaction, though it does require prior access to the machine. No public exploit identified at time of analysis.