EUVD-2026-44090
GHSA-3w29-pr8j-373f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector with an existing low-privileged foothold (AV:L/PR:L), no user interaction, and kernel-level code execution yielding total confidentiality, integrity, and availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
AnalysisAI
Local privilege escalation to code execution in the Windows NTFS driver affects a broad range of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker who can trigger the vulnerable NTFS code path can corrupt heap memory (CWE-122) to run arbitrary code, gaining high confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and the low EPSS score (0.31%, 23rd percentile) together with CISA SSVC 'Exploitation: none' indicates no observed exploitation, though the total technical impact keeps it patch-worthy.
Technical ContextAI
NTFS (New Technology File System) is the default on-disk file system for Windows, implemented as a kernel-mode driver (ntfs.sys) that parses volume metadata, file records, and attribute structures. The flaw is a CWE-122 heap-based buffer overflow, meaning attacker-influenced input causes NTFS to write past the bounds of a dynamically allocated (paged/non-paged pool) buffer. Because the parsing occurs in kernel context, overwriting adjacent heap structures can be leveraged to hijack execution flow at high privilege. The affected CPEs enumerate Microsoft Windows across client SKUs (Windows 10 1607/1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server SKUs (Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations), reflecting shared NTFS code across the entire supported Windows lineage.
RemediationAI
Apply the Microsoft security update for CVE-2026-50482 via Windows Update or the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50482); Patch available per vendor advisory. Upgrade each affected build to at or above its fixed revision - for example Windows 11 24H2 to 10.0.26100.8875, Windows Server 2025 to 10.0.26100.33158, Windows Server 2022 to 10.0.20348.5386, Windows 10 22H2 to 10.0.19045.7548, and Server 2012 R2 to 6.3.9600.23291 (see the full EUVD list for others). Because exploitation requires an authenticated local presence, compensating controls until patching completes include tightening local account provisioning and removing unnecessary interactive/local logon rights so fewer principals can run the triggering code, and enforcing application allowlisting (e.g. Windows Defender Application Control) to hinder an attacker from staging a local exploit; the trade-off is administrative overhead and possible disruption to legitimate local tooling. These controls reduce but do not eliminate exposure, so they are a bridge, not a substitute for the update. NVD reference: https://nvd.nist.gov/vuln/detail/CVE-2026-50482.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today