Windows NTFS CVE-2026-96867

Exploitation requires the attacker to already hold a low-privileged but authenticated local session on the affected Windows system (PR:L, AV:L) - there is no remote or network path and no second-user interaction is needed (UI:N). The trigger is processing of attacker-influenced NTFS on-disk structures/metadata by the NTFS driver, so the attacker needs the ability to run code or mount/present a crafted NTFS volume on the host. Limiting factors: the local-only vector means this is a privilege-escalation/post-exploitation bug, not an initial-access flaw, and it is bounded to the broad but specific build ranges listed for Windows 10 (1607-22H2), Windows 11 (23H2-26H2), and Windows Server 2012 through 2025 below their respective patched builds; systems already updated to the fixed builds are not affected.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms a local attack vector requiring low-level privileges (PR:L), so exploitation is not remote and the attacker must already have authenticated access to the target host - this materially caps the threat compared to a network-reachable flaw. The high impact metrics (C:H/I:H/A:H) and the description's 'execute code locally' outcome mean a successful exploit yields full local code execution, making this a classic privilege-escalation / post-compromise building block rather than an initial access vector. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world urgency therefore rests on CVSS alone. Note a minor tension in the metadata: the vulnerability is a CWE-125 out-of-bounds READ (an information-disclosure primitive), yet the description and C:H/I:H/A:H claim full code execution - this is plausible for NTFS kernel-mode parsing bugs where a read primitive is chained into control-flow corruption, but the exact mechanism is not detailed by the vendor. Given the ubiquity of Windows and the typical use of such local EoP bugs in exploit chains, patch on a normal-to-prompt cycle rather than treating it as a drop-everything issue.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g., via phishing, a compromised service account, or an initial foothold) runs a crafted program or places a malicious NTFS structure that triggers the out-of-bounds read in the NTFS driver. By controlling the out-of-bounds memory access, the attacker escalates to code execution in the local security context. No public exploit code was identified at time of analysis, and no user interaction by a second party is required (UI:N).