EUVD-2026-44103
GHSA-gww4-2hxm-6jr7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel driver flaw needing a low-privileged local account (AV:L, PR:L), no interaction, low complexity, yielding full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
AnalysisAI
Local privilege escalation to code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) that an authenticated local attacker can trigger to run arbitrary code with elevated privileges. The flaw was reported by Microsoft and spans a broad range of currently-supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and reliable memory-corruption primitive in a core kernel-mode driver make it a strong candidate for patch-Tuesday prioritization.
Technical ContextAI
NTFS is the default file system driver (ntfs.sys) running in Windows kernel mode, so it parses on-disk metadata structures, reparse points, and file/attribute records with the highest privilege in the OS. CWE-122 (heap-based buffer overflow) here means attacker-influenced data - typically a malformed file, volume image, or crafted metadata processed by the driver's pool allocations - is written past the bounds of a kernel heap (pool) buffer, corrupting adjacent kernel objects. Because the corrupted memory lives in the kernel pool, a successful overwrite can be groomed into a controlled write primitive that escalates the caller from a normal user context to SYSTEM. The CPE set confirms the affected components are Microsoft Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025 including Server Core installations.
RemediationAI
Vendor-released patch: available from Microsoft - apply the security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50494, selecting the fixed build that matches each affected OS (Windows 10 1607 through Windows Server 2025 and Server Core). The primary and recommended action is to deploy the monthly cumulative/security update via Windows Update, WSUS, or your patch-management tooling; exact fixed build numbers are listed per-SKU in the MSRC entry and should not be assumed. Because this is a local kernel-mode overflow with no configuration toggle to disable NTFS (it is the boot file system), there is no clean feature-level workaround; the practical compensating controls until patching are to restrict local/interactive logon and standard-user code execution (application allowlisting such as WDAC/AppLocker to limit what unprivileged processes can run), enforce least privilege to shrink the pool of local accounts that could reach the driver, and monitor EDR for kernel-exploitation and pool-corruption indicators - noting these controls raise the bar but do not remove the vulnerability.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today