Windows NTFS CVE-2026-83712

Exploitation requires the attacker to already hold a low-privileged authenticated local session on the Windows system (PR:L, AV:L) and the ability to initiate NTFS operations - e.g., mounting, parsing, or writing a crafted file or volume that the NTFS driver processes. No user interaction is needed (UI:N) and the attack complexity is low (AC:L), but the strict local-only vector means it cannot be triggered remotely and is not automatable at scale (SSVC Automatable: no); it is realistically a second-stage privilege-escalation primitive used after initial access is already established. Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025, so unpatched systems below the fixed build numbers are the limiting prerequisite.

This is a locally-exploitable out-of-bounds write (CWE-787) in Windows NTFS carrying CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent but point to a moderate-priority, not drop-everything, issue: the attack vector is strictly local (AV:L) and requires an authenticated foothold (PR:L), which caps the real-world urgency despite the HIGH confidentiality/integrity/availability impact. CISA's SSVC framework reinforces this - Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with a local vuln that cannot be sprayed at scale), while Technical Impact is 'total' (consistent with the triple-HIGH CVSS impact and likely SYSTEM-level code execution via a kernel/filesystem component). There is no CISA KEV listing and no POC referenced in the provided data, and no EPSS score was supplied, so there is no evidence of imminent mass exploitation. Net assessment: a genuine privilege-escalation / local code-execution flaw in a ubiquitous component that should be patched on normal priority, typically chained after an attacker already has a low-privileged foothold, rather than an internet-facing emergency.

An attacker who has already obtained a low-privileged authenticated session on a Windows host (e.g., via phishing or stolen credentials) crafts a malicious NTFS structure or file-system operation that triggers the out-of-bounds write in the NTFS driver, corrupting memory to execute attacker-controlled code at elevated (likely SYSTEM) privilege. No user interaction is required (UI:N). No public exploit code is identified at time of analysis, so a working exploit would need to be developed.