Windows NTFS CVE-2026-69425

Exploitation requires local code execution on the affected Windows 11 system with at minimum a standard (low-privilege) user account - remote unauthenticated exploitation is not possible given AV:L/PR:L. The attacker must be able to create symbolic links or NTFS junction points in a directory accessible to the triggering privileged operation; on Windows 11 with default settings, standard users can create symlinks only if the SeCreateSymbolicLinkPrivilege is granted (it is granted by default in Developer Mode). High attack complexity (AC:H) indicates a timing dependency - the attacker must win a TOCTOU race between symlink creation and privileged file access, limiting reliable automation. The vulnerability does not apply to Windows 10 or Windows Server based on available EUVD version data.

The CVSS base score of 4.7 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N reflects a moderate-severity local tampering primitive. The high attack complexity (AC:H) suggests a race condition or precise timing requirement - consistent with TOCTOU (time-of-check-time-of-use) symlink attacks common in this class. The integrity impact is High (I:H), meaning a successful attacker can write to privileged files, but there is no confidentiality or availability impact per the CVSS. No EPSS data was provided and the vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation. No public exploit code was identified. Real-world risk is meaningful for multi-tenant or shared Windows 11 systems where local code execution by untrusted users is possible, but AC:H substantially limits opportunistic exploitation. The 'Information Disclosure' tag in the input is inconsistent with both the description ('tampering') and the CVSS (C:N, I:H) - this appears to be a metadata error.

A local attacker with a standard user account creates a malicious NTFS symbolic link or junction point in a writable directory, pointing from an expected file path to a sensitive system file (e.g., a configuration file or binary writable only by SYSTEM). When a privileged Windows process - such as a service, installer, or the NTFS driver itself - performs a file write operation and resolves the link without adequate validation, it writes attacker-controlled data to the redirected privileged path. Exploiting AC:H likely requires winning a race condition between link creation and file access, a well-understood technique on Windows using tools like CreateSymbolicLink with appropriate timing.