EUVD-2026-44240
GHSA-g8r4-5q4c-44fv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) triggers a low-complexity kernel overflow with no interaction, yielding SYSTEM and full C/I/A impact in an unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows NTFS file system driver allows an authenticated low-privileged user to gain SYSTEM-level rights by triggering an integer overflow (CWE-190) during filesystem processing. It affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; a vendor patch is available from Microsoft.
Technical ContextAI
The flaw lives in NTFS, the default file system driver (ntfs.sys) that runs in the Windows kernel and processes on-disk structures, metadata, and file operations for essentially every modern Windows installation. CWE-190 (Integer Overflow or Wraparound) indicates that a size, length, or index calculation wraps past its maximum representable value, producing an undersized allocation or out-of-bounds computation; Microsoft's own tags also flag this as a Buffer Overflow, consistent with an overflow-driven memory corruption where the wrapped integer feeds a subsequent buffer operation. Because NTFS executes in kernel context, corruption here translates directly into kernel-mode primitives. The CPE set spans Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025, indicating the vulnerable code path is long-standing and shared across the NTFS driver lineage.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56182 for each affected SKU as listed in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56182, which enumerates the exact fixed build numbers per Windows version (exact fix builds not reproduced in this input, so consult the advisory for the precise KB and build for your release). This is a kernel driver (NTFS) defect with no practical feature-level workaround, since NTFS cannot be disabled on a Windows system, so prompt patching is the only reliable fix; prioritize deployment on multi-user, terminal-server, and shared workstation hosts where untrusted low-privileged users can execute code. Until patched, reduce exposure by tightening who can run code on affected hosts (limit interactive/local logon rights and application execution via AppLocker/WDAC) and monitor for anomalous local privilege escalation behavior, accepting that these are detective/limiting controls rather than a true mitigation of the underlying overflow.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today