Windows NTFS CVE-2026-50672

Exploitation requires the attacker to already have local, authenticated access to the target Windows host as a low-privileged user (CVSS PR:L, AV:L) and the ability to execute code that performs NTFS file-system operations; no user interaction from a victim is needed (UI:N). Limiting factors: high attack complexity (AC:H) indicates a race/timing-dependent use-after-free that will not succeed reliably on the first attempt, and there is no remote or unauthenticated path - the attacker must first obtain code execution on the machine by other means. The bug is present in default configurations because NTFS is the standard Windows file system, so no special feature toggle is required.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) describes a locally-exploitable, low-privileged bug with full confidentiality, integrity, and availability impact but high attack complexity - consistent with a use-after-free race condition that requires precise timing/heap grooming to win. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent exploitation. This is therefore a real but second-tier priority: it requires an attacker to already have code execution on the host as a normal user, and the AC:H rating means reliable exploitation is non-trivial. It is most relevant as a post-compromise privilege-escalation primitive (e.g., escaping a sandbox or moving from a standard account to SYSTEM) rather than an internet-facing emergency. No SSVC decision data was provided; the tags mention 'Denial Of Service' which is consistent with the A:H impact but the primary vendor-stated impact is privilege elevation.

An attacker who already has a foothold as a standard user - for example through phishing malware or a compromised low-privilege service - runs a crafted program that repeatedly issues NTFS file operations to trigger and win the use-after-free race, corrupting kernel memory to gain SYSTEM privileges. From there they disable security tooling, install persistence, and access other users' data on the host. No public POC is referenced, and the AC:H rating means the exploit likely needs multiple attempts to succeed.