Windows NTFS CVE-2026-50667

Exploitation requires the attacker to already have local, authenticated access with low privileges (PR:L) - for example a standard user account or a foothold from prior code execution - and the ability to run code that drives concurrent NTFS operations on the target volume; no user interaction is needed (UI:N). Limiting factors are significant: the attack is local only (AV:L, no remote/network path) and carries high complexity (AC:H) because success depends on winning a non-deterministic timing race that may require many attempts and is not reliably automatable (SSVC Automatable: no). This makes multi-user, terminal-server, and shared systems where untrusted accounts can execute code the realistic risk surface, while single-user endpoints with no untrusted local access are largely insulated.

The signals are consistent and point to a genuine but not emergency-tier local escalation. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) requires local access and already-held low privileges, and the high attack complexity reflects the inherent unreliability of winning a kernel race; SSVC corroborates this with Exploitation: none and Automatable: no, but rates Technical Impact: total because a successful win yields full SYSTEM control. EPSS of 2.16% (80th percentile) is elevated but not alarming, aligning with the fact that public exploit code exists yet no active exploitation is confirmed - this is NOT in CISA KEV. The one notable inconsistency is that the vendor tags label this 'Information Disclosure' while the NVD description and CVSS I:H/PR:L clearly describe privilege elevation; treat this as a privilege-escalation issue per the authoritative description and verify scope of disclosure with Microsoft's advisory. Net priority: a solid patch-this-cycle item for multi-user, terminal-server, and shared-workstation environments, lower urgency for single-user endpoints with no untrusted local accounts.

A low-privileged user or malware already running as a standard account on a shared workstation or Remote Desktop server repeatedly triggers concurrent NTFS operations to hit the synchronization window, and on a successful race gains SYSTEM privileges to disable defenses, install persistence, or access other users' data. Because publicly available exploit code exists, the barrier to attempting this is low, though the AC:H timing dependency means the attacker may need many iterations to succeed.