Windows NTFS CVE-2026-69875

The attacker must hold a valid low-privilege Windows account (domain or local) sufficient to authenticate to a network share - anonymous/unauthenticated access is insufficient per PR:L in the CVSS vector. Additionally, a victim user must perform an action that causes the vulnerable NTFS code path to process attacker-supplied filesystem data (UI:R), such as browsing, opening, or mounting a malicious network share. The exploitation vector is network-based (AV:N), consistent with SMB/NTFS network share access rather than requiring physical or local console access. Exploitation is limited by: (1) requirement for valid credentials, (2) requirement for victim user interaction with attacker-controlled content, and (3) no scope change meaning the attacker gains elevated privilege on the victim system only, not beyond it.

The CVSS 8.0 base score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a credible network-exploitable privilege escalation with full CIA impact, tempered by the requirement for a low-privilege account (PR:L) and user interaction (UI:R). The PR:L requirement means an anonymous internet attacker cannot exploit this directly - valid credentials or a domain account are prerequisites, which meaningfully reduces real-world automated exploitation risk. UI:R further constrains mass exploitation but is consistent with SMB-based heap corruption scenarios where a user must access or interact with a malicious or weaponized share. No EPSS score, KEV listing, or public proof-of-concept was present in the input data. Given the ubiquitous deployment of Windows NTFS and the high CIA impact, organizations with exposed SMB infrastructure or internal shared-drive environments should treat this as high priority, even without active exploitation evidence. The combination of AC:L (no special timing or race conditions) and full CIA impact suggests reliable exploitation once the attacker holds credentials and interaction is achieved.

An attacker with a low-privileged Windows domain account on a corporate network lures or waits for a target user to connect to an attacker-controlled SMB share (e.g., via a phishing link or UNC path in a document). When the victim's system accesses the share, the attacker's crafted NTFS metadata triggers a heap overflow in the NTFS kernel driver, allowing the attacker to overwrite kernel heap structures and execute arbitrary code at SYSTEM privilege on the victim's machine. No public proof-of-concept has been identified at time of analysis.