Windows NTFS CVE-2026-50461

Exploitation requires the victim to actively interact with attacker-supplied NTFS file-system data (UI:R) - the attacker must get the user to mount, open, or otherwise process a crafted NTFS volume, disk image, or file on the local machine (AV:L). No prior authentication or privileges on the target are needed (PR:N), and attack complexity is low (AC:L). The key limiting factor is that this is not remotely triggerable without user action: the attacker cannot exploit it purely over the network, and there is no evidence of self-propagation. Any affected Windows build (Server 2012 through Windows 11 26H1 / Server 2025) in default configuration is susceptible once the malicious file system is processed.

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes a locally-triggered but high-impact flaw: no privileges are required (PR:N) but user interaction is (UI:R), which typically means the victim must mount, open, or otherwise process a malicious NTFS volume/file. This aligns with the description's 'execute code locally.' No EPSS score, SSVC decision, or POC signal was provided in the input, so exploitation probability cannot be quantified from this data alone. It is not in CISA KEV, so there is no evidence of active exploitation; the primary risk driver is the ubiquity of NTFS combined with the low complexity (AC:L) and lack of privilege requirement. Realistically this is an elevation/execution primitive gated by user interaction - a solid patch priority given deployment breadth, but not a remote wormable issue.

An attacker crafts a malicious NTFS-formatted volume - for example a USB drive, VHD/VHDX, or disk image with corrupted file-system metadata - and delivers it to a victim. When the user mounts or browses the volume, the malformed structures trigger the heap overflow in the kernel NTFS parser, allowing the attacker to run code in the victim's context. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means reliable triggering is plausible once the file system is processed.