Windows NTFS CVE-2026-96935

Exploitation requires the attacker to already have local, interactive or code-execution access to the Windows host as an authenticated low-privileged user (CVSS PR:L), with no user interaction from a victim needed (UI:N). There is no remote attack path - the attacker must run code locally against the NTFS component. Limiting factors: the need for pre-existing valid credentials/foothold, confinement to the local machine, and impact limited to information disclosure with no integrity or availability effect, which together make this a post-compromise capability rather than an initial-access vector. Affects default NTFS-based installations across the listed Windows 10/11 and Windows Server 2012-2025 builds below the patched versions.

This is a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity attack that requires the attacker to already hold valid low-privileged credentials on the target; impact is confined to confidentiality (C:H) with no integrity or availability effect. All exploitation signals point low: CISA SSVC scores Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no KEV listing and no public exploit identified at time of analysis. The signals are internally consistent - a local, authenticated info-disclosure flaw is exactly the kind of issue that SSVC would deprioritize, and the absence of an EPSS value in the input is unremarkable for a freshly published Microsoft Patch-Tuesday-class CVE. No contradictions were found between the CVSS vector and the description: both agree on local access by an already-authorized user. The main risk driver is prevalence, not exploitability - Windows NTFS is on effectively every Windows host - so the flaw matters at fleet scale as a post-compromise information-gathering primitive rather than as an initial-access or wormable threat. Note the C:H rating: Microsoft rates many such NTFS memory/system-information leaks as High confidentiality even when the concretely disclosed data (e.g. kernel memory contents or filesystem metadata) is narrow, so treat 'high confidentiality impact' as vendor-assigned rather than independently verified.

An attacker who has already gained a low-privileged foothold on a Windows machine (for example via phishing or stolen credentials) runs a crafted local operation against the NTFS driver to read sensitive system information such as uninitialized kernel memory or filesystem metadata that they should not be able to see. The disclosed data (potentially pointers, tokens, or memory contents) is then used to aid privilege escalation or further lateral movement. No public exploit code has been identified, and exploitation requires local code execution as an authenticated user, limiting it to post-compromise use.