EUVD-2026-35559
GHSA-6798-vf82-f698
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Windows NTFS allows an unauthorized attacker to run arbitrary code on the target system by triggering a heap-based buffer overflow, with no public exploit identified at time of analysis. The CVSS 7.8 rating reflects high impact across confidentiality, integrity, and availability, but exploitation requires local vector and user interaction. Microsoft (secure@microsoft.com) is the assigning CNA, indicating a first-party vendor advisory via MSRC.
Technical ContextAI
NTFS (New Technology File System) is the default file system driver for Windows, implemented in the kernel-mode ntfs.sys driver. CWE-20 (Improper Input Validation) is the assigned root cause class, manifesting here as a heap-based buffer overflow - meaning attacker-controlled input is not properly validated for size or structure before being written to a heap allocation, corrupting adjacent memory. Because NTFS parsing runs in kernel context, memory corruption in this code path is a classic vector for local privilege escalation and kernel code execution. No CPE strings were provided in the input, so the precise affected Windows builds must be retrieved from the MSRC advisory.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45636, which lists the exact KB numbers for each affected Windows SKU; exact fix build numbers were not included in the input data and must be retrieved from MSRC. Until the update is deployed, compensating controls include blocking the mounting of untrusted external volumes and disk images (group policy can restrict removable storage and disable automount of VHD/VHDX files, at the cost of blocking legitimate external drive use), restricting the ability of standard users to open arbitrary file attachments via attachment manager and Mark-of-the-Web enforcement, and monitoring endpoint telemetry for NTFS parser crashes and ntfs.sys faults that may indicate exploitation attempts. Avoid disabling NTFS itself, as it is the primary Windows file system and not a feasible workaround.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-20 – Improper Input Validation
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today