EUVD-2026-73044
GHSA-xr24-9gh3-5687
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable via SMB, low-privilege account required, user interaction needed to trigger NTFS path; full CIA impact post-escalation to SYSTEM.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid low-privilege Windows account (domain or local) sufficient to authenticate to a network share - anonymous/unauthenticated access is insufficient per PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 base score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a credible network-exploitable privilege escalation with full CIA impact, tempered by the requirement for a low-privilege account (PR:L) and user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: apply the applicable Windows cumulative update bringing each affected build to or above the minimum fixed build - 10.0.17763.9245 for Windows 10 1809 and Server 2019, 10.0.19044.7725 for Windows 10 21H2, 10.0.19045.7725 for Windows 10 22H2, 10.0.22631.7582 for Windows 11 23H2, 10.0.26100.9445 for Windows 11 24H2, 10.0.26100.33438 for Windows Server 2025, 10.0.26200.9445 for Windows 11 25H2, 10.0.28000.2954 for Windows 11 26H1, and 10.0.20348.5622 for Windows Server 2022. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Windows desktop and server systems in your environment and validate the vendor patch in an isolated test lab to ensure compatibility with critical applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows 10 1809
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows contains an elevation of privilege vulnerability known as 'HiveNightmare' or 'SeriousSAM' where overly permissiv
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today