EUVD-2026-43860
GHSA-j9xg-4cpc-v6m7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel-driver privilege escalation requiring a low-privileged foothold (AV:L, PR:L), low complexity and no interaction, granting full SYSTEM control (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows NTFS file-system driver allows an authenticated attacker to run code with elevated (SYSTEM-level) privileges by triggering a stack-based buffer overflow (CWE-121). The flaw was reported by Microsoft and affects a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.8 (High).
Technical ContextAI
NTFS is the default file system driver (ntfs.sys) built into every supported Windows client and server edition, running in kernel mode. The root cause is CWE-121, a stack-based buffer overflow: NTFS parsing/handling code writes attacker-influenced data past the bounds of a fixed-size stack buffer, corrupting the kernel stack (saved return address, adjacent locals, or stack cookies). Because NTFS executes in ring 0, controlled corruption of kernel stack memory can be leveraged to redirect execution or overwrite privileged data, converting a low-privileged local context into full SYSTEM control. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_11_version_26h1, plus windows_server_2012/2012_r2 and their Server Core installations) confirms the exposure spans the standard NTFS implementation shared across these OS versions rather than an optional component.
RemediationAI
Apply Microsoft's security update for the affected OS build as the primary and complete fix; a vendor patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50412, which lists the exact KB and fixed build number for each Windows and Windows Server version (consult it to map your specific edition, including Server Core, to the correct KB). Because the flaw is in the core NTFS driver there is no practical feature-level workaround - NTFS cannot be disabled on a Windows system - so patching is the only reliable remediation. As compensating controls until patching completes, minimize the population of low-privileged interactive/local users on affected hosts (this bug requires a local low-privileged foothold, PR:L), enforce least privilege and application allow-listing to reduce the chance an attacker can run the exploit binary, and prioritize domain controllers, multi-user/RDS hosts, and Server Core systems where untrusted local code is more likely; note these controls reduce but do not eliminate the risk and add operational overhead.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today