Windows NTFS CVE-2026-50494

Exploitation requires the attacker to already have local, authenticated access with at least low privileges (CVSS PR:L) - i.e., the ability to run code as a standard user on the target Windows system; no user interaction is needed (UI:N) and no special NTFS feature toggle is called out, so default configurations are exploitable once local access is obtained. The concrete prerequisite is the capability to drive NTFS parsing/allocation paths (supplying crafted file-system data or triggering the vulnerable driver operation) from that unprivileged context. Limiting factors that reduce realistic risk: the attack cannot be launched remotely (AV:L rules out network-only attackers), it needs a pre-existing local account or code execution, and it is bounded to the affected Windows/Windows Server versions in the CPE list; it does not itself provide initial access.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning local access and low existing privileges are required but no user interaction, and impact is full confidentiality, integrity, and availability compromise - the classic profile of a local elevation-of-privilege in a kernel driver. No EPSS score, KEV listing, or POC signal was provided, so exploitation likelihood cannot be quantified from the input; the absence of KEV means it is not confirmed to be actively exploited. The realistic risk is that this is a dependable second-stage EoP: not a remote entry point, but highly valuable to any attacker who already has code execution as a standard user (malware, phishing payload, or a chained remote bug) and needs SYSTEM. Given NTFS is present on essentially every Windows host and attack complexity is low, treat it as a real prioritization item despite the merely-High (not Critical) score; the local vector is the only material limiting factor.

An attacker who already holds a low-privileged foothold on a Windows host - for example via a phishing payload or a compromised standard user account - invokes crafted file-system operations or supplies malformed NTFS metadata that the kernel driver mishandles, overflowing a pool buffer to corrupt kernel memory and elevate to SYSTEM. Given AV:L/AC:L, exploitation is local and low-complexity, so it fits naturally as the privilege-escalation stage of a broader intrusion. No public exploit identified at time of analysis, so any operational exploit would currently need to be developed by the attacker.