Windows NTFS CVE-2026-50668

Exploitation unconditionally requires physical access to the target device - this is the primary and hardest prerequisite. The CVSS vector AV:P/PR:N/UI:N/AC:L indicates the attacker needs no operating system credentials and no interaction from a logged-in user; physical presence at the machine is sufficient. The most plausible delivery mechanism is mounting a specially crafted NTFS volume (e.g., via a USB drive), which NTFS processes at an elevated privilege level. Exploitation is limited by: physical proximity to the device, which rules out remote or network-based attack paths; the need to interact with the physical machine without interruption; and the absence of any known public exploit at this time. No special software configuration or non-default Windows settings are cited as required - any Windows system with the NTFS driver loaded (essentially all Windows installations) and physical access exposure is theoretically in scope.

The CVSS base score of 6.8 is driven primarily downward by the AV:P (Physical) attack vector, which is the dominant risk-limiting factor. Despite all three impact metrics being rated High - indicating full confidentiality, integrity, and availability compromise - the physical access requirement dramatically constrains exploitability in typical enterprise network-connected environments. No EPSS score was provided in source data; its absence means exploitation probability cannot be quantified from that signal. This CVE is not listed in the CISA KEV catalog and no publicly available exploit code is identified at time of analysis, further lowering near-term automated threat risk. Real-world priority is highest for shared workstations, public kiosks, unattended servers, or devices exposed to insider threats where physical access is realistic. For hardened, physically secured infrastructure this is a lower operational priority despite the High impact metrics.

An attacker with physical access to an unattended Windows workstation or server inserts a USB drive containing a crafted NTFS filesystem volume designed to trigger the heap buffer overflow in the Windows NTFS driver during volume mounting or directory traversal. The overflow corrupts adjacent heap memory, enabling the attacker to redirect execution flow and elevate from a low-privileged or unauthenticated session context to SYSTEM-level privileges. No public proof-of-concept code has been identified, but the attack complexity is rated Low (AC:L), suggesting that once a working exploit is developed, reliable triggering requires no race conditions or advanced heap-grooming techniques.