Windows NTFS CVE-2026-71329

Exploitation requires direct physical access to the target machine - the attacker must attach an external storage device (USB flash drive, external hard disk, or similar) containing a maliciously crafted NTFS volume. The NTFS kernel driver processes the volume's metadata upon attachment, triggering the heap overflow without requiring any OS-level authentication (consistent with PR:N in the CVSS vector). The Windows auto-mount and volume enumeration behavior is what exposes the vulnerable code path; disabling auto-mount via Group Policy or physically blocking USB ports directly prevents exploitation. There is no network attack surface: AV:P confirms the vulnerability cannot be triggered remotely. Exploitation is further limited to the 19 unpatched Windows build variants listed in the EUVD data; fully patched systems at or above the fixed build numbers are not affected.

The CVSS base score of 6.8 reflects a meaningful tension: full CIA impact (C:H/I:H/A:H) representing kernel-level code execution, constrained by a physical attack vector (AV:P) that dramatically narrows the attacker population to those with hands-on access. This is not a remotely exploitable vulnerability, and the absence of a CISA KEV listing and lack of identified public exploit code further reduce immediate operational urgency for most organizations. However, for environments with elevated physical-access risk - unattended kiosks, public-facing terminals, industrial control systems, classified or high-security facilities, and unmonitored server rooms - this vulnerability is a meaningful threat given Windows auto-mount behavior. The breadth of the affected product list (19 distinct Windows release variants from Server 2012 through current) indicates this is not a fringe edge case but a systemic defect in NTFS parsing. EPSS data was not provided in source intelligence; risk prioritization should be driven by physical access exposure rather than CVSS score alone.

An attacker with brief unattended physical access to a Windows workstation or server inserts a USB drive pre-formatted with a specially crafted NTFS volume containing malformed filesystem metadata. Windows auto-mounts the volume and the NTFS kernel driver processes the malicious structures, triggering a heap buffer overflow in kernel space. Successful exploitation grants the attacker kernel-level code execution without needing to log into the operating system, enabling installation of a bootkit, credential harvesting tools, or persistent implants.