Windows NTFS CVE-2026-62700

The CVSS vector AV:L/PR:L confirms that exploitation requires the attacker to have local code execution capability and at minimum a low-privileged user account on the target Windows system - this includes interactive logon sessions, RDP sessions, or execution via a previously compromised low-privilege process or service account. No special non-default configuration is documented as a prerequisite: NTFS is the mandatory default filesystem on all Windows installations, so the vulnerability surface is present across standard deployments without any additional enablement required. Exploitation is bounded by the local attack vector (AV:L) - remote unauthenticated exploitation is not possible per the CVSS vector. The unchanged scope (S:U) limits direct impact to the compromised host. The primary limiting factor for defenders is therefore controlling who holds interactive or service-level logon rights on exposed systems.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-severity local privilege escalation: low complexity, no user interaction, and a full C/I/A triad on the compromised host. The PR:L requirement limits the attacker pool to accounts with at least interactive or service-account-level access, excluding purely remote unauthenticated scenarios, but in practice any domain user, RDP participant, or compromised low-privilege service account qualifies. EPSS data was not included in the provided intelligence package, so probabilistic exploitation rate cannot be quantitatively assessed - this gap should be closed by consulting the FIRST EPSS API directly. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit has been identified, which tempers immediate urgency compared to an in-the-wild exploited flaw; however, the sheer footprint of affected products means that even a mid-sized municipal IT team in gdynia should treat this as urgent patching within their standard monthly cycle rather than deferring it. The scope-unchanged (S:U) metric confirms exploitation is bounded to the local host, limiting lateral movement risk to post-escalation activity. No realistic workaround exists since NTFS cannot be disabled on Windows systems.

A low-privileged domain user or compromised service account logged into a Windows host executes a specially crafted application or filesystem operation designed to trigger the heap-based buffer overflow in ntfs.sys. The resulting kernel heap corruption overwrites adjacent memory structures - such as security token pointers - allowing the attacker to elevate their process to SYSTEM-level privileges. No public proof-of-concept has been identified at time of analysis, so current exploitation would require independent vulnerability research or access to private exploit tooling.