Windows NTFS CVE-2026-96927

Exploitation requires the attacker to already be an authenticated local user with low privileges on the target Windows host (PR:L, AV:L) and to supply crafted input that drives the NTFS driver into an out-of-bounds read; no user interaction by another party is needed (UI:N). Limiting factors: there is no remote vector - the attacker must first obtain local code execution or an interactive session, and CISA SSVC assesses the flaw as not automatable with only partial technical impact, so it functions as an information-disclosure primitive (e.g., leaking adjacent memory) rather than a direct path to code execution or privilege escalation. The flaw affects a broad range of supported Windows client and server builds below the patched versions listed in the EUVD data.

This is a genuine but low-priority vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 MEDIUM) describes a locally-exploitable, low-complexity flaw requiring an already-authenticated low-privileged user, yielding high confidentiality impact but no integrity or availability impact - consistent with memory-disclosure from an out-of-bounds read (CWE-125) in the NTFS driver. Every corroborating signal points to low real-world urgency rather than high-CVSS-but-overrated: SSVC from CISA rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no CISA KEV listing and no public proof-of-concept. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are mutually consistent (no conflicts): local-only vector plus required privileges plus 'not automatable' plus info-disclosure-only impact all indicate this is a privilege-limited information-leak useful mainly as a secondary step (e.g., defeating ASLR or reading adjacent kernel/file-system memory), not a standalone remote compromise. Priority: patch in normal cycles; it is not an emergency.

A low-privileged local user who already has code execution on the host runs a crafted program that forces the NTFS driver to perform an out-of-bounds read, returning adjacent memory contents to the attacker. The leaked data could expose sensitive kernel or file-system memory usable to bypass mitigations or escalate a broader attack chain. No public exploit code has been identified, and exploitation requires prior local authenticated access and attacker-supplied triggering input.