Windows NTFS CVE-2026-72935

Exploitation requires a locally authenticated account with high privileges (PR:H per vendor CVSS vector) on an unpatched Windows system using NTFS as its filesystem - which is the default for all Windows installations. The attack vector is strictly local (AV:L); remote exploitation is not indicated. No user interaction is required once the attacker has the necessary account level. The primary limiting factors are: (1) the attacker must already hold an elevated/high-privilege local account, ruling out unprivileged insiders or remote-only attackers without prior foothold; (2) the attack is non-remotely triggerable; (3) the scope remains unchanged (S:U), meaning the exploit does not directly pivot to other systems. The vulnerability affects all Windows NTFS volumes by default, so no special NTFS configuration or feature enablement is required beyond the attacker holding a qualifying account.

The CVSS base score of 6.7 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a local privilege escalation requiring a high-privilege starting point, which meaningfully constrains real-world exploitability - an attacker must already control an elevated account before triggering the flaw. Despite the C:H/I:H/A:H impact triad, the requirement for PR:H limits the attack population to scenarios where an attacker already holds administrator-equivalent access, making the incremental privilege gain (e.g., Administrator to SYSTEM) narrower in value than a typical unprivileged-to-admin LPE. No public exploit exists and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. EPSS data is absent from the provided input. SSVC considerations: exploitation requires an authorized account (not automatable at scale), the flaw is not remotely triggerable, and Microsoft's broad patch release across all supported Windows versions signals high vendor confidence in the severity of the underlying read primitive even if the exploitability bar is elevated.

An attacker who has already obtained a high-privilege local account - through credential theft, phishing, or lateral movement - logs into a vulnerable Windows system and invokes a privileged NTFS operation (such as a specific volume management call or IOCTL) that triggers the out-of-bounds read in the NTFS kernel driver. The read leaks kernel memory contents, which the attacker leverages to defeat kernel ASLR or craft a follow-on primitive to achieve SYSTEM-level code execution. No public exploit code exists at time of analysis, so practical exploitation likely requires bespoke kernel exploitation tradecraft.