Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Requires an existing low-privileged local session (AV:L/PR:L), triggers reliably without user interaction (AC:L/UI:N), and yields SYSTEM-level kernel code execution (C:H/I:H/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 19:10 vuln.today
CVE Published
Jul 14, 2026 - 17:09 nvd
HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows NTFS driver lets an already-authenticated attacker corrupt heap memory to run code at a higher privilege level (typically SYSTEM) on affected Windows 10, Windows 11, and Windows Server builds. Microsoft reported the issue and has shipped a fix; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. With CVSS 7.8 (AV:L/PR:L) it is a valuable post-compromise pivot rather than an initial-access bug.

Technical ContextAI

NTFS is the default on-disk file system driver in every modern Windows release, running in kernel mode as part of the core OS. The flaw is CWE-122, a heap-based buffer overflow: the NTFS driver writes past the bounds of a dynamically allocated kernel heap buffer, likely while parsing attacker-influenced file-system structures or metadata. Because the affected code executes in ring 0, controlled heap corruption can be groomed to overwrite adjacent kernel objects or function pointers, converting a memory-safety bug into arbitrary code execution at kernel privilege. The CPE set covers the Windows kernel/NTFS component across Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2012 through 2025.

RemediationAI

Patch available per vendor advisory: apply the Microsoft cumulative update for your specific Windows/Windows Server build as listed in the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56175, which provides the exact patched build number for each affected SKU (no single cross-SKU version string is published). Prioritize multi-user and shared systems (RDP/Citrix hosts, domain controllers, jump boxes) where a low-privileged foothold most easily exists. No specific pre-patch workaround is documented by Microsoft for NTFS heap corruption; because NTFS cannot be disabled, the practical compensating controls are to limit local/interactive logon rights and remove unnecessary standard-user accounts to shrink the pool of attackers who can reach the vulnerable code, and to monitor EDR for suspicious process token elevation - these reduce but do not eliminate exposure and have no functional downside beyond tighter access management.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-56175 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy