Windows NTFS CVE-2026-58640

Exploitation requires the attacker to already possess local, low-privileged authenticated access to the target Windows machine (CVSS PR:L, AV:L), from which they can execute code or issue crafted NTFS file system operations. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-only vector means it cannot be triggered remotely over a network - it is a post-access privilege-escalation primitive, not an initial-access vector. Limiting factors: the attacker must first obtain a foothold with at least a standard user account on the host, and only unpatched builds below the fixed versions are affected; there is no evidence the flaw can be triggered against default configurations without prior local access.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 High) describes a local, low-complexity attack requiring only low privileges and no user interaction, delivering total impact to confidentiality, integrity, and availability - consistent with the SSVC 'Technical Impact: total' rating. However, SSVC also records 'Exploitation: none' and 'Automatable: no', and EPSS is low (0.29%, 21st percentile), and there is no KEV listing and no public exploit identified at time of analysis. Taken together, this is a genuine local privilege-escalation primitive with maximal technical impact but currently no evidence of exploitation and no self-propagating potential - a solid patch-cycle priority rather than an emergency. Its real-world weight comes from the enormous install base and its value as a post-compromise escalation step, not from imminent mass exploitation. No data conflicts were noted: the local attack vector matches the 'execute code locally' description.

An attacker who has already gained a low-privileged foothold on a Windows host - for instance through phishing, a compromised service account, or an unprivileged user session - invokes crafted NTFS operations that trigger the heap overflow in the file system driver. Because the flaw needs no user interaction and has low attack complexity, the attacker corrupts kernel heap memory to escalate from limited user to SYSTEM. No public exploit is identified at time of analysis, so this would require the attacker to develop or acquire a working exploit.