Windows NTFS CVE-2026-96916

Requires the attacker to already hold a low-privileged authenticated local session on the Windows host (PR:L), from which they invoke a crafted operation handled by the NTFS driver. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but exploitation is strictly local (AV:L) - it cannot be launched remotely over the network and requires a prior foothold. It affects default configurations of all listed Windows and Windows Server versions below the patched builds (e.g., Windows Server 2022 <10.0.20348.5761, Windows 11 24H2 <10.0.26100.9711), since NTFS is the default filesystem; the main limiting factor is the need for existing local code execution.

This is a credible, patch-now priority for Windows fleets despite not being a remote-code-execution bug. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local, low-complexity privilege escalation requiring only an existing low-privileged authenticated session, with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a 7.8 HIGH base score. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no confirmed signal of active exploitation or available exploit code - meaning this is 'no public exploit identified at time of analysis.' SSVC framing: exploitation=none observed in this data, automatable=no (local EoP typically requires existing foothold, not automatable mass exploitation), technical impact=total. The real-world driver of risk here is not exploitation probability signals (which are absent) but the extreme prevalence of the affected component - NTFS ships in every supported Windows and Windows Server release. Local privilege-escalation flaws in the Windows kernel/filesystem are historically high-value for post-compromise chaining and are frequently added to KEV after initial disclosure, so the absence of a POC today should not be read as low urgency. No signals conflict; the primary limitation is the missing EPSS/KEV/POC telemetry, which prevents a confident exploitation-likelihood estimate.

An attacker who has already obtained low-privileged code execution on a Windows host (e.g., via phishing, a compromised service account, or a standard user login) triggers a crafted operation against the NTFS driver that overflows a heap buffer, corrupting kernel memory to gain SYSTEM privileges. Because the vector is local with low complexity and no user interaction, this is a reliable second-stage escalation once initial access exists. No public exploit code is identified at time of analysis, but NTFS local EoP bugs are commonly weaponized post-disclosure.