Windows NTFS CVE-2026-96217

Exploitation requires the attacker to already have local, authenticated access to the target with at least low-level user privileges (CVSS PR:L) and the ability to execute code that performs crafted NTFS filesystem operations to trigger the heap overflow; the vector is local only (AV:L), so this cannot be triggered remotely over the network. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning no race condition or special timing is required. The primary limiting factor is the prerequisite foothold - a standard unauthenticated remote attacker cannot use this directly; it functions as a post-compromise privilege-escalation step. Affected systems are those running the enumerated unpatched Windows builds (Windows 10/11 across multiple versions, Windows Server 2012 through 2025, including Server Core installations).

This is a genuine patch-priority issue for Windows environments despite not reaching the 'critical' tier. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a locally-triggered flaw requiring only low existing privileges, no user interaction, and low attack complexity, yielding full confidentiality, integrity, and availability impact on the host - the classic profile of a local privilege-escalation (LPE) bug that converts a foothold into SYSTEM. Several key exploitation signals are MISSING from the input: there is no EPSS score, no SSVC decision data, and no explicit POC indicator, so widespread or automated exploitation cannot be asserted. KEV status is not listed, so this is NOT confirmed as actively exploited - treat it as no public exploit identified at time of analysis. The main factors elevating real-world priority are independent of those missing signals: NTFS is a core component present on effectively every Windows installation, a vendor patch is available, and NTFS/kernel LPE bugs are historically attractive as the second stage of intrusion chains (post-phishing, post-RCE). The main factor limiting urgency is the local attack vector - an attacker must already have code execution with at least low privileges on the target, so this is a privilege-amplification bug, not a remote entry point.

An attacker who has already gained an initial low-privileged foothold on a Windows host (for example via phishing, a malicious document, or a compromised standard user account) runs a crafted program that issues malformed NTFS operations to trigger the heap-based buffer overflow in the filesystem driver. By corrupting kernel heap memory in a controlled way, the attacker elevates to SYSTEM and takes full control of the machine. No public exploit was identified in the provided data, but low attack complexity and no required user interaction make reliable exploitation plausible once details are known.