EUVD-2026-43860
GHSA-j9xg-4cpc-v6m7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel-driver privilege escalation requiring a low-privileged foothold (AV:L, PR:L), low complexity and no interaction, granting full SYSTEM control (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows NTFS file-system driver allows an authenticated attacker to run code with elevated (SYSTEM-level) privileges by triggering a stack-based buffer overflow (CWE-121). The flaw was reported by Microsoft and affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.8 (High).
Technical ContextAI
NTFS is the default file system driver (ntfs.sys) built into every supported Windows client and server edition, running in kernel mode. The root cause is CWE-121, a stack-based buffer overflow: NTFS parsing/handling code writes attacker-influenced data past the bounds of a fixed-size stack buffer, corrupting the kernel stack (saved return address, adjacent locals, or stack cookies). Because NTFS executes in ring 0, controlled corruption of kernel stack memory can be leveraged to redirect execution or overwrite privileged data, converting a low-privileged local context into full SYSTEM control. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_11_version_26h1, plus windows_server_2012/2012_r2 and their Server Core installations) confirms the exposure spans the standard NTFS implementation shared across these OS versions rather than an optional component.
RemediationAI
Apply Microsoft's security update for the affected OS build as the primary and complete fix; a vendor patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50412, which lists the exact KB and fixed build number for each Windows and Windows Server version (consult it to map your specific edition, including Server Core, to the correct KB). Because the flaw is in the core NTFS driver there is no practical feature-level workaround - NTFS cannot be disabled on a Windows system - so patching is the only reliable remediation. As compensating controls until patching completes, minimize the population of low-privileged interactive/local users on affected hosts (this bug requires a local low-privileged foothold, PR:L), enforce least privilege and application allow-listing to reduce the chance an attacker can run the exploit binary, and prioritize domain controllers, multi-user/RDS hosts, and Server Core systems where untrusted local code is more likely; note these controls reduce but do not eliminate the risk and add operational overhead.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today