Windows NTFS EUVD-2026-100257

Exploitation requires the attacker to already have local, authenticated access to the Windows host as at least a low-privileged user (AV:L, PR:L) and the ability to execute code that interacts with the NTFS filesystem driver to trigger the untrusted pointer dereference. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the key limiting factor is that this is NOT remotely reachable - the attacker must first gain a local foothold, so it functions as a privilege-escalation/post-exploitation step rather than an initial access vector. It affects default Windows configurations across the listed builds (Windows 10/11, Windows Server 2012 through 2025); no special non-default feature needs to be enabled, only an unpatched version prior to the fixed builds.

This is a locally-exploitable elevation-of-privilege flaw in the Windows NTFS driver (CWE-822, untrusted pointer dereference) rated CVSS 7.8 (HIGH). The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N confirms it requires local access and some pre-existing privileges (PR:L, i.e. an authenticated low-privileged user) but no user interaction, with low attack complexity and full confidentiality/integrity/availability impact (C:H/I:H/A:H) on an unchanged scope. There is no EPSS score, no CISA KEV listing, and no public POC referenced in the provided data, so there is no evidence of active exploitation or weaponization at this time - exploitation status is 'no public exploit identified at time of analysis.' The realistic priority is driven by the ubiquity of Windows and the classic value of a kernel EoP primitive (it chains after initial access to reach SYSTEM), rather than by remote mass-exploitability: because AV:L requires the attacker to already have a foothold, this is a second-stage/privilege-escalation issue, not an internet-facing entry point. Note a data conflict to verify: the input Tags include 'Information Disclosure,' but both the description ('elevate privileges locally') and the CVSS impact (I:H/A:H, not just C:H) indicate an elevation-of-privilege vulnerability, not a pure information-disclosure issue - treat the tag as suspect. Given that Microsoft self-reported it (secure@microsoft.com) and a patch is already available, prompt patching is warranted on the normal monthly cadence despite the absence of exploitation signals.

A low-privileged but authenticated attacker who already has local code execution on a Windows host (for example via phishing, a malicious application, or a compromised standard user account) runs a crafted program that triggers the untrusted pointer dereference in the NTFS driver. By controlling the dereferenced pointer, the attacker corrupts kernel memory to escalate from the standard user context to SYSTEM. No public exploit code is referenced in the provided data, and no user interaction is required (UI:N).