Windows NTFS CVE-2026-50471

Exploitation requires local delivery plus user interaction: per the CVSS vector (AV:L, UI:R) the attacker must induce the victim to open or mount attacker-controlled NTFS content - such as a malicious VHD/VHDX, ISO, or removable/mounted volume - so the vulnerable NTFS parser processes the malformed heap structures. No prior authentication or elevated privileges are needed (PR:N), and attack complexity is low (AC:L), so no special timing or configuration is required beyond the victim's action. The limiting factors are the mandatory user interaction and the local (non-remote) vector: the flaw cannot be triggered across the network without a user opening the crafted content, which constrains exploitation to social-engineering or physical-access delivery.

The signals are internally consistent and point to a serious but not top-tier-urgent issue. The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: local attack vector, low complexity, no privileges required, but mandatory user interaction, with full confidentiality, integrity, and availability impact and unchanged scope. There is no EPSS score, no KEV listing, and no POC in the provided data, so exploitation is currently theoretical - no public exploit identified at time of analysis. The combination of AV:L and UI:R means an attacker cannot trigger this over the network unassisted; they must get a user to interact locally (open/mount attacker-supplied content), which materially lowers real-world exploitability compared with a raw 7.8. This is a real patch-worthy priority given the enormous install base, but absent KEV/POC/EPSS signals it is not an emergency; treat it as a standard high-severity Patch-Tuesday-class fix. No conflicting signals were found in the data.

An attacker crafts a malicious NTFS structure - for example a booby-trapped VHD/VHDX or a removable volume with corrupted MFT metadata - and delivers it to a target via download, email, or physical media. When the victim opens or mounts the crafted volume, the NTFS driver mis-parses the malformed heap data, triggering the overflow and executing the attacker's code locally with the process's privileges. No public exploit is identified at time of analysis, and the low attack complexity means a working exploit would be reliable once developed, but the mandatory user interaction gates the attack.