Windows NTFS CVE-2026-62880

Exploitation requires a locally authenticated user account with at least standard (non-administrator) user privileges - confirmed by the CVSS PR:L metric. The attacker must be able to execute arbitrary code on the local system, achievable via interactive console login, Remote Desktop Protocol (RDP) session, or delivery of a malicious executable to a user who runs it. No special NTFS configuration, non-default Windows features, or elevated privileges are required prior to exploitation, as NTFS is the default file system on all affected Windows releases. Exploitation is strictly local: the CVSS AV:L vector confirms that remote unauthenticated exploitation is not possible. The primary limiting factor is the requirement for local code execution, which confines the attack to insiders, users who have been socially engineered into running a payload, or attackers who have already achieved initial access through another vector. All supported Windows releases from Server 2012 to Windows 11 26H1 are in scope with no version exemptions within the stated ranges.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: a local attacker with standard user credentials, no required user interaction, and low exploitation complexity can achieve complete SYSTEM-level control. The Low attack complexity rating is a meaningful signal - it suggests the exploitation primitive does not require precise heap feng shui or race conditions, making it more reliably reproducible once understood. EPSS data was not provided in the available intelligence, so quantitative exploitation probability cannot be stated. The vulnerability is absent from the CISA KEV catalog, and no public proof-of-concept exploit has been identified at time of analysis - these are meaningful limiting factors against opportunistic mass exploitation in the near term. However, the ubiquitous deployment footprint of Windows NTFS across enterprise endpoints, RDP servers, and multi-tenant environments means that the realistic attacker population who can satisfy the PR:L prerequisite (any user with a login) is extremely large. The combination of confirmed C:H/I:H/A:H impact and no special configuration requirement means this should be treated as urgent regardless of KEV or POC status, particularly for environments exposing RDP or running shared Windows Server workloads.

A standard domain user on an unpatched Windows endpoint or RDP server runs a locally compiled malicious binary that issues crafted file system calls or constructs malformed NTFS structures, triggering the out-of-bounds read in ntfs.sys. The kernel memory contents disclosed by the read are used to compute the runtime base address of ntfs.sys or the Windows kernel, defeating KASLR, after which the attacker chains a secondary write primitive to redirect execution and obtain a SYSTEM-privileged shell or token. No public proof-of-concept has been identified at time of analysis, but the CVSS AC:L rating indicates the exploit path does not require complex preconditions.