EUVD-2026-44066
GHSA-5qqr-8vg7-hvq7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local, low-privilege kernel-parsing flaw with no user interaction (AV:L/PR:L/UI:N) yielding kernel code execution, hence full C/I/A impact and unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
AnalysisAI
Local privilege escalation to code execution in the Windows NTFS driver (CVE-2026-50417) allows an authenticated attacker with low privileges to corrupt heap memory and run arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems. The flaw is a heap-based buffer overflow (CWE-122) reported by Microsoft, with CVSS 7.8 (High) reflecting local vector, low complexity, and full confidentiality/integrity/availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
NTFS (New Technology File System) is the default file system for Windows, implemented in the kernel-mode driver ntfs.sys. Parsing of on-disk metadata structures (MFT records, attribute lists, index buffers) happens in privileged kernel context, so memory-safety bugs there translate directly into kernel code execution. CWE-122 (heap-based buffer overflow) indicates that attacker-influenced length or offset values cause a write past the bounds of a heap (pool) allocation - a classic root cause for NTFS filesystem-parsing flaws, often triggered by a maliciously crafted volume image (e.g., a mountable VHD or removable disk) or specially structured file operations. The affected CPE set spans client SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations).
RemediationAI
Vendor-released patch: available per the Microsoft Security Response Center advisory - apply the monthly cumulative security update that addresses CVE-2026-50417 for your specific Windows build via Windows Update, WSUS, or your patch-management tooling, referencing https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50417 for the exact KB numbers per SKU. Because exploitation requires local low-privileged access, interim compensating controls include restricting the ability of untrusted users to mount arbitrary volumes or disk images (disable or restrict automatic mounting of removable media and VHD/ISO files, which limits the crafted-filesystem attack surface but may disrupt legitimate media/VHD workflows) and enforcing least-privilege on interactive and service accounts to reduce the pool of low-privileged attackers who could reach the flaw. Prioritize patching Server Core and multi-user/RDS hosts where untrusted local principals are most likely.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today