Windows NTFS CVE-2026-68875

Exploitation requires an authenticated local session on the target Windows system with at minimum low-privilege user rights (PR:L), consistent with the CVSS vector AV:L/AC:L/PR:L/UI:N. The attacker must be able to perform NTFS file system operations, which is standard for any interactive or service account. No special configuration, non-default feature, or specific protocol beyond NTFS access is required. Exploitation is limited to local attack surface - remote unauthenticated exploitation is not possible. Constraints: the attacker must have local logon access (interactive, RDP, or equivalent service context); fully isolated environments without local user access are not reachable.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 and accurately reflects a local, low-complexity, low-privilege privilege escalation - a well-understood and practically exploitable attack class in Windows kernel drivers. EPSS data is not provided; however, NTFS driver vulnerabilities with full C/I/A impact have historically attracted exploit development attention due to the ubiquity of the target. No KEV listing and no public POC have been identified at time of analysis, which tempers the immediacy of the threat. The extremely broad affected-version range (13+ distinct Windows product lines) significantly expands the attack surface. The AC:L rating means no race conditions or special timing are required, making reliable exploitation more feasible once an attacker has local access. Priority for remediation should be elevated on multi-user systems, terminal servers, and environments where local access by untrusted users is possible.

A low-privileged local user on a Windows file server authenticates interactively or via Remote Desktop, then triggers a crafted NTFS operation - such as opening a specially structured file or volume - that causes the NTFS kernel driver to read beyond its intended buffer boundary. The over-read surfaces sensitive kernel memory that is subsequently used in a way enabling kernel-mode code execution, resulting in full SYSTEM-level privilege escalation. No public POC has been identified at time of analysis.