Windows NTFS CVE-2026-83652

Exploitation requires the attacker to already have authenticated local code-execution ability on the target host as at least a standard (low-privileged) user, per PR:L and AV:L - this is not remotely reachable and cannot be triggered across the network or via a browser. The vulnerable component is the core NTFS filesystem driver, which is present and active by default on all supported Windows client and server builds listed in the EUVD data (Windows 10/11 across 1607-26H2, Windows Server 2012 through 2025, including Server Core installations), so no special feature toggle or non-default configuration is needed beyond normal NTFS use. The primary limiting factor is the local-access prerequisite: an external unauthenticated attacker cannot use this directly, making it a post-compromise escalation primitive rather than an initial-access vector; no user interaction (UI:N) is required once local access is held.

This is a credible, patch-now local privilege escalation rather than a high-CVSS-but-low-real-risk issue, though it is not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a locally-exploitable flaw in the Windows NTFS driver that requires low privileges (PR:L) - i.e. any authenticated local user - with low attack complexity and no user interaction, yielding full confidentiality, integrity and availability impact on the host. Mapping to the SSVC framework: technical impact is 'total' (C:H/I:H/A:H against a kernel-mode component), but exploitation is not currently automatable in the SSVC sense because the attacker must already have local code execution, and exploitation status is 'none' based on available signals. No EPSS score, CISA KEV entry, or public POC was provided in the input; per the precision rules this means 'no public exploit identified at time of analysis' - EPSS and KEV absence is expected for a freshly-disclosed vendor-reported bug and should NOT be read as evidence of safety. The signals are internally consistent (a local heap overflow matching AV:L with PR:L for a privilege-escalation primitive), so there is no CVSS-vs-description conflict to flag. Real-world priority is driven by prevalence and the role of this flaw as a reliable second-stage escalation primitive: on a platform as ubiquitous as Windows, any malware or low-privileged foothold could chain this to SYSTEM, so it warrants prompt patching even without current exploitation evidence.

An attacker who already has a low-privileged foothold on a Windows host - via phishing, a malicious installer, or stolen standard-user credentials - runs a crafted program that issues malformed NTFS operations to trigger the heap-based buffer overflow in the NTFS driver. By grooming the kernel heap and corrupting adjacent structures, the attacker gains code execution in kernel context, elevating from a standard user to SYSTEM. No public exploit code was identified at time of analysis, and the flaw cannot be reached remotely without prior local access.