EUVD-2026-100017
GHSA-qq8x-4qf9-642x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryRun crafted NTFS-triggering program
-
ExploitTrigger use-after-free in NTFS driver
-
ExecutionCorrupt kernel memory for code execution
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess authenticated low-privileged (PR:L) local code execution on the target Windows system - there is no remote or network-facing path, as the vector is local (AV:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once a foothold exists, triggering the NTFS use-after-free is reliable against default configurations. The requirement for pre-existing local access and valid credentials is the principal limiting factor, confining this to post-compromise privilege escalation on supported Windows client and server editions below the patched builds listed in the EUVD data. |
| Impact | This is a genuine, patch-now priority for Windows fleets despite the moderate 7.8 CVSS. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity local privilege escalation requiring only existing low-level authenticated access and no user interaction, yielding full confidentiality, integrity, and availability impact on the host. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation at this time - the realistic use case is as a post-compromise local privilege-escalation step rather than an initial-access remote bug. The absence of exploitation signals is the key mitigant: the ceiling on risk is high (kernel-level EoP in a core OS component present on effectively every Windows host), but the current observed exploitation is zero. Note a conflict between the input Tags, which list 'Denial Of Service', and the official description plus CVSS, which describe privilege elevation with full CIA impact - the primary impact is elevation of privilege, not DoS; verify impact framing against the Microsoft MSRC advisory. The low-privilege prerequisite (PR:L) and local-only vector (AV:L) meaningfully limit real-world risk versus a remote unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker who has already gained a foothold on a Windows host as a standard (low-privileged) user runs a crafted program that abuses the NTFS use-after-free to corrupt kernel memory and execute code with SYSTEM privileges. Because attack complexity is low and no user interaction is needed, this serves as a reliable local privilege-escalation link in a broader intrusion. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Microsoft Windows NTFS allows an authenticated attacker who already holds low-privileged code execution on a host to abuse a use-after-free in the file system driver and obtain SYSTEM-level rights. The vector is strictly local (AV:L, PR:L, UI:N, AC:L) - there is no remote or network-facing path, and no user interaction is required, so once an initial foothold exists the trigger is reliable against default configurations. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but our assessment treats it as a genuine patch-now priority for Windows fleets despite the moderate 7.8 CVSS; the pre-existing local access requirement is the principal limiting factor.
RemediationAI
Patch availability: patch available per vendor advisory - Microsoft has released fixes for CVE-2026-83859 through the MSRC update guide, with the fixed build levels being 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2) and 10.0.26100.33650 (Windows Server 2025 and Server Core), 10.0.26200.9711 (Windows 11 25H2), 10.0.26300.9711 (Windows 11 26H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.19044.7807 (Windows 10 21H2 and 22H2), 10.0.17763.9376 (Windows Server 2019, Windows 10 1809 and Server Core), 10.0.14393.9612 (Windows Server 2016, Windows 10 1607 and Server Core), 10.0.20348.5761 (Windows Server 2022) and 6.3.9600.23470 (Windows Server 2012 R2 and Server Core); apply the corresponding cumulative update from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83859 and reboot, since ntfs.sys is loaded at boot and cannot be hot-patched. Because NTFS is a core component it cannot be disabled or isolated as a workaround, so until every host is updated the practical compensating controls are all about denying the PR:L precondition rather than blocking the bug itself: enforce least privilege and remove unnecessary interactive logon and local administrator rights (trade-off: increased helpdesk and application-compatibility friction, and it does not stop an attacker who already has a low-privileged session from triggering the bug); deploy WDAC or AppLocker application control to prevent untrusted binaries and scripts that could carry the trigger from running (trade-off: allowlist curation and periodic update of publisher rules); and enable Credential Guard plus attack-surface-reduction rules to make credential theft after a successful escalation harder (trade-off: driver and virtualization compatibility requirements on older hardware). Detection should focus on unexpected ntfs.sys bugchecks, unusual handle or volume-mount activity by non-administrative processes, and post-exploitation indicators such as SYSTEM-owned process creation from low-privileged parents, since the exploit itself leaves few artifacts in file system metadata. Prioritize the update for multi-user servers, Remote Desktop and VDI hosts, and any environment where untrusted users or contractors already have interactive access, as those are the scenarios where the PR:L foothold is cheapest to obtain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NTFS is the kernel-mode Windows file system implementation (ntfs.sys) that parses the master file table, resident and non-resident attribute streams, and volume metadata, and services file and volume I/O from user mode. The root-cause class is CWE-416, use-after-free: memory backing an internal structure is released while a live reference to it remains, so a subsequent operation dereferences the stale pointer and can be groomed into interpreting attacker-influenced data as kernel objects. Because ntfs.sys runs in ring 0 in the context of the calling thread, a successful exploitation path converts a controlled stale-pointer dereference into kernel memory corruption - typically arbitrary kernel read/write leading to token or process-object manipulation for privilege escalation to SYSTEM. The record's tags (Use After Free, Memory Corruption, Denial Of Service) are consistent with the primitive: a failed or unrefined trigger is most likely to bugcheck the machine rather than elevate, while a refined one yields elevation. All affected software is Windows client and server under the legacy 10.0.x and 6.3.x build trains; no CPE strings were supplied with the record, so the authoritative version matrix is Microsoft's update guide and the build thresholds in the EUVD data.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local NTFS UAF needs existing low-privileged code execution (AV:L, PR:L) with no interaction and low complexity, yielding SYSTEM-level code execution and full CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity flaw in the Microsoft Windows NTFS file system driver allows an attacker who has already established a low-privileged foothold on a host to escalate to full SYSTEM-level control, which could expose sensitive data and accelerate lateral movement from an initial compromise. Because the vector is strictly local, external attackers cannot reach it directly, but any Windows machine breached through another route becomes significantly harder to contain. For leadership, the practical exposure is measured in containment cost and blast radius rather than widespread opportunistic attack, and it is addressable through a routine Windows update cycle.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB