Windows NTFS CVE-2026-62887

Exploitation requires a local user account with at minimum standard (low-privilege) permissions - no administrator or elevated rights are needed, consistent with CVSS PR:L. The attacker must have the ability to interact with an NTFS volume on the target system, which is the default configuration for any Windows installation using NTFS (the standard filesystem). No non-default configuration or special feature flag is required beyond the presence of an NTFS volume. What limits exploitation: the attack is strictly local (AV:L) - no network-based exploitation path exists; the vulnerability is not automatable per SSVC, meaning mass exploitation is not feasible; and scope is unchanged (S:U), preventing lateral movement or privilege escalation directly from this flaw. The primary realistic constraint is the requirement for a local interactive or terminal-services session.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the constrained threat model: attack vector is local (AV:L), complexity is low (AC:L), privileges required are low (PR:L), and scope is unchanged (S:U), meaning exploitation cannot cascade to other system components. The high confidentiality sub-score (C:H) is the primary driver and reflects that kernel memory disclosure can expose sensitive data such as tokens, credentials, or cryptographic material residing in adjacent memory. SSVC signals reinforce the measured risk: exploitation status is 'none', the vector is not automatable, and technical impact is rated 'partial'. No CISA KEV listing and no POC availability further confirm this is not actively targeted. Despite the broad affected-version surface, the local-only attack vector substantially limits exposure - network-facing systems without interactive local logons face minimal realistic risk. Multi-user environments, RDS hosts, and endpoints where untrusted local users operate represent the highest-priority remediation targets. No conflicting signals identified; CVSS vector and description are fully consistent.

A low-privileged local user on a shared Windows host - such as an RDS session host or a developer workstation - mounts or interacts with a crafted or malformed NTFS volume, triggering the out-of-bounds read in ntfs.sys. The driver reads kernel pool memory beyond the intended buffer, and the leaked contents are surfaced to the attacker, potentially exposing authentication tokens, session keys, or other sensitive data resident in kernel memory at the time of the read. No public proof-of-concept code is currently known, so an attacker would need to independently identify the triggering condition.