Windows NTFS CVE-2026-96918

Requires the attacker to already have local, authenticated low-privileged code execution on an affected Windows host (PR:L, AV:L) - this is a post-foothold elevation-of-privilege flaw in the NTFS filesystem driver, not a remotely reachable or unauthenticated bug. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a standard-user foothold exists, escalation to SYSTEM is reliable. Limiting factors: the attacker must first gain local execution (e.g., via phishing, an existing account, or a chained remote bug), and the target must be an unpatched build below the fixed versions listed in EUVD-2026-100247 (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2022 below 10.0.20348.5761, Server 2016 below 10.0.14393.9612). No non-default configuration is called out in the description; NTFS is the default Windows filesystem so all listed editions are affected out of the box.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity privilege escalation requiring an authenticated low-privileged foothold (PR:L) and no user interaction, yielding full confidentiality/integrity/availability impact within an unchanged scope. The real-world exploitation signals are consistently LOW: SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, and the CVE is NOT in CISA KEV with no public POC identified. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The signals are therefore aligned rather than conflicting - a high-impact local EoP that is not yet exploited and not automatable. One tension to flag: SSVC Technical Impact is rated 'partial' whereas the CVSS impacts are all High (C:H/I:H/A:H); these two frameworks score impact differently, so the 'partial' SSVC rating should not be read as contradicting the CVSS severity. Because exploitation requires existing local authenticated access, this is typically chained as a post-compromise step rather than an initial-access vulnerability; prioritize patching on multi-user and shared Windows hosts but it is not an emergency drop-everything issue absent active exploitation.

A low-privileged authenticated user (or malware running in a standard user context after initial access) runs a crafted program that abuses an improper access-control/authorization flaw in the Windows NTFS driver to elevate to SYSTEM. No user interaction is required and attack complexity is low, but the attacker must already be able to execute code locally on the host. No public exploit code has been identified at time of analysis.