EUVD-2026-43940
GHSA-f76x-f2rf-3qc8
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector with required user interaction to open crafted NTFS content, no privileges needed, full CIA impact from in-context code execution matching a memory-corruption RCE.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer overflow that lets an attacker run arbitrary code with the privileges of the affected process. The flaw affects a broad swath of supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft (the reporter) has shipped a patch; there is no public exploit identified at time of analysis, and the CVSS vector requires local access plus user interaction, so it is a privilege-escalation/code-execution primitive rather than a remotely-wormable bug.
Technical ContextAI
NTFS is the default on-disk filesystem driver bundled with every modern Windows release; it parses complex on-disk metadata structures (MFT records, attributes, index buffers) in a privileged/kernel context when a volume, VHD, or file is mounted or accessed. The root cause is CWE-122, a heap-based buffer overflow, meaning attacker-controlled data written to a heap allocation exceeds its bounds and corrupts adjacent heap memory or allocator metadata. Because NTFS parsing runs in a trusted context, corrupting its heap can be steered into controlled code execution. The CPE set enumerates Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012 among affected products, and the tags additionally list Server 2012 R2, 2016, 2019, 2022, and 2025 including Server Core installations.
RemediationAI
Apply the Microsoft security update for CVE-2026-50471 - Patch available per vendor advisory - via Windows Update or WSUS/Intune across all affected client and server SKUs, prioritizing internet-facing and multi-user systems; the advisory and downloadable packages are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50471. Because the attack requires a user to interact with attacker-supplied filesystem content, effective compensating controls until patching completes include blocking or restricting the mounting of untrusted VHD/VHDX and ISO images and removable media (trade-off: disrupts legitimate workflows that rely on mounted images), enforcing AppLocker or SmartScreen policies and user education against opening unsolicited disk images, and limiting local logon rights on shared hosts (trade-off: administrative overhead). No NTFS-specific configuration workaround is published, so patching is the definitive fix.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today