Windows NTFS CVE-2026-56182

The attacker must already have local, authenticated access to the target host with at least low-level privileges (CVSS PR:L), and the ability to execute code locally that interacts with the NTFS file system to trigger the overflow; there is no network vector and no victim interaction is required (AV:L, UI:N). Limiting factors: this is not remotely exploitable and cannot be launched by an unauthenticated outsider - an initial foothold is a prerequisite, making it a post-exploitation/second-stage capability. The affected code is in the always-present NTFS kernel driver on default installations of the listed Windows client and server versions, so no special non-default configuration or feature toggle is needed once local access is achieved.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8 (High) and describes a realistic, high-value local privilege escalation: local vector, low complexity, low privileges required, no user interaction, unchanged scope, and full high impact to confidentiality, integrity, and availability - the canonical profile of a kernel EoP used as a second stage after initial access. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The vulnerability is not present in CISA KEV and no POC was reported, so there is no evidence of active exploitation; however, NTFS kernel EoP bugs are historically attractive to ransomware and post-exploitation toolkits, so absence of current exploitation should not be read as low future risk. There is no signal conflict: the description ('elevate privileges locally') is fully consistent with the AV:L/PR:L vector. Priority is driven by the near-universal deployment footprint and the reliable SYSTEM outcome rather than by remote reachability.

An attacker who has already obtained a low-privileged foothold on a Windows host - for example via phishing, a compromised service account, or a standard user session on a shared server - runs a crafted local program that drives NTFS into the vulnerable size calculation, triggering the integer overflow and corrupting kernel memory to elevate to SYSTEM. Given AC:L and no required user interaction, exploitation is straightforward once local access exists, though a working exploit would need to be developed since no public POC is identified at time of analysis.