Windows NTFS CVE-2026-65784

Exploitation requires an authenticated local session with at minimum low-privilege user rights (confirmed by CVSS PR:L), and the attacker must be able to issue filesystem operations handled by the Windows NTFS kernel driver - a condition met on any Windows system using an NTFS-formatted volume, which encompasses essentially all Windows deployments. No special NTFS feature enablement, non-default configuration, or elevated permissions are required beyond the ability to log on locally or via RDP. Remote, unauthenticated exploitation is explicitly excluded by the AV:L vector; the flaw cannot be triggered over a network protocol without pre-existing authenticated local access. Exploitation is further limited to information disclosure only - no integrity modification or denial-of-service capability is indicated, and scope is contained to the single vulnerable system (S:U). The primary limiting factor for defenders is therefore controlling who holds local logon rights on sensitive Windows systems.

The CVSS 3.1 base score of 5.5 (Medium) reflects a locally exploitable, low-complexity flaw requiring only standard user privileges and no user interaction - but explicitly not remotely triggerable, which substantially reduces the attack surface compared to network-vector equivalents. No EPSS probability data was included in the intelligence feed; without it, exploitation likelihood must be inferred from structural signals: the AV:L constraint limits opportunistic mass exploitation, and the absence from CISA KEV indicates no confirmed active exploitation at time of analysis. The real-world risk is therefore most acute in environments where insider threat, shared workstations, RDP-exposed systems, or multi-tenant deployments give untrusted parties local access - for example, even a mid-sized municipal IT team in gniezno running a mixed Windows estate of Server 2019 and Windows 10 endpoints should treat this as a routine patch-cycle priority rather than an emergency out-of-band response. SSVC framing places this at 'exploitation: none, automatable: no, technical impact: partial,' suggesting a scheduled remediation posture for most organizations. One data tension: the 'Buffer Overflow' tag conflicts with the CWE-125 (Out-of-bounds Read) classification - defenders should not assume a write primitive or escalation to code execution without further vendor clarification, as the current evidence supports information disclosure only.

A local user with a standard low-privilege account on an unpatched Windows system crafts a malformed NTFS filesystem operation and submits it to the kernel NTFS driver, triggering the out-of-bounds read. The driver reads beyond the intended buffer boundary, exposing kernel memory contents - potentially including pointer values, session tokens, or cryptographic material - that the attacker can capture and analyze for further privilege escalation or lateral movement. No public proof-of-concept code has been identified at time of analysis, meaning exploitation currently requires independent vulnerability research or access to non-public tooling.