Windows NTFS CVE-2026-68851

Exploitation requires a local, authenticated session on the target system with at least standard (low-privileged) user rights - confirmed by the CVSS PR:L metric. The attacker must be able to invoke NTFS-related filesystem operations, which is achievable by any logged-in user with access to an NTFS volume (the default for all Windows installations). No special NTFS configuration, elevated privileges, third-party software, or network exposure is required. Limiting factors include: (1) local access is mandatory - purely network-facing services are not directly exploitable; (2) the vulnerability yields information disclosure only, with no direct code execution or integrity impact; (3) exploitation value increases only when chained with a separate privilege escalation step that benefits from leaked kernel memory. Remote exploitation would first require obtaining a low-privileged local shell through another vector.

The CVSS 5.5 score appropriately reflects a medium-severity local information disclosure. The attack vector (AV:L) and privilege requirement (PR:L) significantly limit the threat surface: the attacker must already have a local interactive or remote shell session with at least standard user rights. The high confidentiality impact (C:H) indicates that exploitation can yield substantial data - potentially kernel memory contents - but integrity and availability are unaffected (I:N/A:N, S:U). No EPSS data was supplied in the input, and the vulnerability is absent from CISA KEV, indicating no confirmed in-the-wild exploitation. For enterprise environments, the primary risk is post-compromise lateral movement or privilege escalation assistance via kernel pointer disclosure (e.g., defeating KASLR). The wide version range (from Windows Server 2012 to Windows 11 26H1) increases aggregate exposure across large mixed-version fleets. Risk is real but not urgent for well-patched environments; priority rises for organizations running legacy Windows Server 2012/2012 R2 where patch cadence may lag.

An attacker with a low-privileged local shell session on an unpatched Windows host crafts a specially formed NTFS filesystem operation that triggers the buffer over-read in ntfs.sys. The driver reads beyond the buffer boundary and returns the excess memory contents back to userland, potentially exposing kernel pointers that can defeat ASLR/KASLR and assist in chaining a subsequent privilege escalation exploit. No public proof-of-concept has been identified at time of analysis, making spontaneous exploitation less likely in the near term.