Windows NTFS CVE-2026-50448

Exploitation requires local delivery of a crafted NTFS file-system structure (a malicious volume, disk image such as VHD/VHDX/ISO, or file) plus victim user interaction (UI:R) to mount or open it, at which point the NTFS driver parses the malformed metadata and triggers the heap overflow. Per the CVSS vector PR:N, the attacker needs no pre-existing privileges or authentication on the target beyond getting their content parsed. Limiting factors: the vector is local (AV:L) not remote, so it cannot be triggered over the network; a legitimate user must be convinced to mount/open the attacker-supplied volume or file; and environments that block untrusted media/image mounting substantially reduce opportunity. The flaw affects default configurations of the listed Windows and Windows Server editions - no special feature toggle is required.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a locally-triggered, low-complexity flaw needing no attacker privileges but gated by user interaction - consistent with a malicious-volume or malicious-file open rather than remote exploitation. Full C/I/A impact reflects potential code execution. No EPSS score, KEV listing, or POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation; practical risk today is moderate and opportunistic, not an emergency. The chief mitigating factors are the local attack vector and the UI:R requirement (a victim must mount or open attacker-supplied content). This is a genuine kernel-level bug worth patching in normal cycles but, absent KEV/EPSS/POC signals, a standard 'Important' item rather than a drop-everything critical. Note: PR:N with UI:R implies the attacker supplies crafted content that a legitimate user then opens - verify the exact trigger against Microsoft's MSRC entry.

An attacker crafts a malicious NTFS volume or disk image (e.g., a VHD/VHDX or USB drive) containing malformed metadata that overflows a heap buffer in ntfs.sys, then delivers it and induces a victim to mount or open it (satisfying UI:R). When Windows parses the crafted structures, the overflow triggers and enables arbitrary code execution. No public exploit was identified at time of analysis, so this reflects the CVSS local/low-complexity profile rather than an observed campaign.