EUVD-2026-43940
GHSA-f76x-f2rf-3qc8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector with required user interaction to open crafted NTFS content, no privileges needed, full CIA impact from in-context code execution matching a memory-corruption RCE.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer overflow that lets an attacker run arbitrary code with the privileges of the affected process. The flaw affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft (the reporter) has shipped a patch; there is no public exploit identified at time of analysis, and the CVSS vector requires local access plus user interaction, so it is a privilege-escalation/code-execution primitive rather than a remotely-wormable bug.
Technical ContextAI
NTFS is the default on-disk filesystem driver bundled with every modern Windows release; it parses complex on-disk metadata structures (MFT records, attributes, index buffers) in a privileged/kernel context when a volume, VHD, or file is mounted or accessed. The root cause is CWE-122, a heap-based buffer overflow, meaning attacker-controlled data written to a heap allocation exceeds its bounds and corrupts adjacent heap memory or allocator metadata. Because NTFS parsing runs in a trusted context, corrupting its heap can be steered into controlled code execution. The CPE set enumerates Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012 among affected products, and the tags additionally list Server 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-50471 - Patch available per vendor advisory - via Windows Update or WSUS/Intune across all affected client and server SKUs, prioritizing internet-facing and multi-user systems; the advisory and downloadable packages are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50471. Because the attack requires a user to interact with attacker-supplied filesystem content, effective compensating controls until patching completes include blocking or restricting the mounting of untrusted VHD/VHDX and ISO images and removable media (trade-off: disrupts legitimate workflows that rely on mounted images), enforcing AppLocker or SmartScreen policies and user education against opening unsolicited disk images, and limiting local logon rights on shared hosts (trade-off: administrative overhead). No NTFS-specific configuration workaround is published, so patching is the definitive fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today