Windows NTFS CVE-2026-61350

Physical presence at the target machine is required - the CVSS vector AV:P explicitly confirms this is a strictly physical-access attack, not remotely exploitable. No authentication is required (PR:N), but the attacker must be physically able to interact with the machine, for example by attaching a crafted external NTFS storage device or booting from external media to cause the NTFS driver to parse a malformed volume. No special non-default NTFS configuration appears to be required; standard NTFS volume mounting under default Windows conditions is the trigger. What limits exploitation: physical security controls preventing unauthorized hardware access, BitLocker encryption (which prevents meaningful access to raw NTFS structures on a locked drive without the recovery key), UEFI Secure Boot and media restrictions blocking external boot, and BIOS/UEFI password enforcement. Remote or automated network-based exploitation is not possible given the physical attack vector.

The CVSS 3.1 base score of 4.6 Medium is driven by the high confidentiality impact (C:H) but substantially tempered by the physical attack vector (AV:P), which mandates adversary co-location with the target hardware. No EPSS score was provided in the source data, and given the physical prerequisite, probabilistic exploitation risk against any networked environment is negligible; even a mid-sized municipal IT department in sanok should treat this as a low-urgency item relative to network-vectored vulnerabilities addressed in the same patch cycle. The vulnerability is confirmed absent from the CISA KEV catalog and no public proof-of-concept has been identified, consistent with no observed mass exploitation. SSVC signals reinforce low prioritization: the attack cannot be automated or executed remotely, technical impact is limited to information disclosure with no integrity or availability effect, and exploitation requires physical presence rather than a scalable delivery mechanism. One notable risk amplifier is the inclusion of Windows Server 2012 and 2012 R2 in the affected version list - these platforms are end-of-life, and organizations still running them without Extended Security Updates enrollment face compounded patching challenges. The primary threat model is theft or physical compromise: lost or stolen endpoints, unattended kiosks, and scenarios involving physical intrusion.

An attacker with brief unsupervised physical access to an unattended Windows machine - such as during an office intrusion, at an unmonitored kiosk, or via a stolen laptop - connects a crafted external drive or boots from a prepared USB device containing a malformed NTFS volume. When the Windows NTFS kernel driver parses the malicious on-disk structure, the buffer over-read condition is triggered, exposing a region of kernel or file system memory that the attacker captures for offline analysis. No public exploit code is known at this time, and no network connectivity or credentials are required.