Windows NTFS EUVD-2026-100250

Requires the attacker to already have local, authenticated access at low privilege (CVSS PR:L) - a standard user account or any low-integrity code execution context on the target Windows system - from which a crafted NTFS filesystem operation triggers the underflow; no user interaction is needed (UI:N). Exploitation is fundamentally limited by the local attack vector: it cannot be performed remotely or over a network, cannot be automated at scale (SSVC Automatable=no), and yields confidentiality impact only (no write/modify or denial-of-service capability). The affected system must run an unpatched NTFS driver within the listed build ranges across Windows 10/11 (including 21H2/22H2/23H2/24H2/25H2/26H1/26H2) and Windows Server 2012 through 2025, including Server Core installations.

This is a genuine but moderate-priority issue, and the signals are notably consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) describes a local, low-complexity, authenticated attack yielding high confidentiality impact only - no integrity or availability effect and no scope change. CISA's SSVC decision framework corroborates the low-urgency picture: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local-access requirement that cannot be sprayed at scale), and Technical Impact=partial. No EPSS score was supplied, and there is no CISA KEV listing and no indication of public POC code, so all exploitation signals point the same direction: this is not an actively-exploited or widely-weaponized flaw. The one tension worth noting is that NTFS information disclosure of this type is commonly used as a secondary primitive (e.g., leaking kernel/pool memory to defeat KASLR) to support a separate privilege-escalation exploit, so its real-world value is higher in a chained context than its standalone 5.5 score implies. Bottom line: a real bug to patch in routine cycles, not an emergency - the local access + low privilege requirement and absence of any exploitation evidence keep real-world risk modest.

An attacker who already has the ability to run low-privileged code on a Windows host (e.g., a standard user account or a compromised low-integrity process) triggers an integer underflow in the NTFS driver through a crafted filesystem operation, causing it to read and return memory outside the intended bounds. The disclosed memory contents can leak sensitive kernel data useful for bypassing exploit mitigations. No public exploit code has been identified, and exploitation requires local access with low privileges and low attack complexity but no user interaction.