Windows NTFS CVE-2026-62796

Exploitation requires that the attacker is already authenticated on the target system with at least low-privilege (standard user) access - confirmed by CVSS PR:L. The flaw is triggered through local interaction with the NTFS driver, meaning the attacker must be able to cause NTFS operations to occur on a crafted or manipulated volume or file path (e.g., by mounting a specially crafted NTFS image or accessing a crafted file). No network access, no user interaction from another user, and no elevated privileges are required beyond initial local logon. Exploitation is constrained to local vectors (AV:L) and cannot be automated across networks (SSVC Automatable: no), which substantially limits mass exploitation. The impact is confidentiality-only: no data modification or service disruption results from triggering this flaw.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately characterizes the risk: exploitation is local, requires low privileges, and yields confidentiality impact only. The EPSS score was not provided in the input, so probabilistic exploitation likelihood cannot be quantified here. SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) corroborates that this is not a high-urgency operational threat - it cannot be chained into an automated attack and requires local access. The 5.5 CVSS base score is consistent with a read-only information disclosure flaw. That said, even a mid-sized municipal IT team in rybnik should treat this as a routine patch-cycle item rather than an emergency, since local access is a prerequisite and no active exploitation has been observed. The primary practical risk is that an attacker who already has a foothold on a system could use this to harvest memory contents, potentially as a step in a multi-stage privilege escalation chain. No KEV listing and no POC exist in the provided data, so urgency is moderate.

A locally authenticated low-privilege user on a Windows system crafts or mounts a specially constructed NTFS volume or file designed to trigger the out-of-bounds read in the NTFS kernel driver. When the driver processes the malformed NTFS structure, it reads beyond the intended buffer boundary, leaking kernel memory contents accessible to the attacker. The attacker then parses the disclosed memory to extract sensitive data - such as cryptographic material or ASLR offsets - for use in a subsequent privilege escalation attempt. No public exploit code has been identified at time of analysis.