Windows NTFS CVE-2026-62797

Exploitation requires an authorized local user account on the target Windows system - CVSS PR:L confirms low-privilege local access is sufficient, meaning any standard domain or local user can attempt exploitation. No user interaction from a second party is required (UI:N), and no elevated privileges are needed to trigger the vulnerable NTFS code path. The attack is constrained to local execution (AV:L); remote exploitation is not possible without a pre-existing foothold. The scope is limited to the compromised host (S:U), so no direct hypervisor or domain controller escalation results from this flaw alone. Exploitation is further limited on systems running end-to-end kernel integrity protections such as Virtualization Based Security (VBS) with Hypervisor-Protected Code Integrity (HVCI), which significantly raises the bar for kernel-mode code execution even if the overflow is triggered.

The CVSS 3.1 score of 7.8 (HIGH) is well-supported by the vector: local access lowers the exposure universe compared to network-reachable vulnerabilities, but AC:L and UI:N mean exploitation requires no special race conditions or victim interaction once local code execution is obtained. The S:U (scope unchanged) signals no direct container or hypervisor escape, limiting blast radius to the compromised host. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no public POC has been identified, suggesting this has not yet been weaponized at scale. However, local privilege escalation primitives in the Windows kernel historically attract rapid exploit development, particularly in post-patch analysis scenarios. The breadth of affected Windows versions - including end-of-life Server 2012 and 2012 R2 - substantially increases real-world risk for organizations with unpatched legacy infrastructure. In environments where endpoint hardening (e.g., Attack Surface Reduction, constrained user accounts) is weak, this is a realistic escalation path post-initial-access.

An attacker who has gained initial access to a Windows host with a standard low-privilege user account (e.g., via phishing or lateral movement) executes a locally crafted program that triggers the heap-based buffer overflow in the NTFS driver by issuing a malformed filesystem request. The overflow corrupts kernel heap metadata or a function pointer, redirecting execution to attacker-controlled shellcode running at SYSTEM privilege. No public exploit code has been confirmed at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction indicate that a reliable exploit is technically feasible once the overflow primitive is understood.