Windows NTFS EUVD-2026-44049

The attacker must already have authenticated local access with at least low-level privileges (CVSS PR:L, AV:L) and the ability to execute code on the target Windows host; no network access, no user interaction, and no special or non-default configuration is required, since NTFS is the default Windows file system present on all listed SKUs. Limiting factors: exploitation is strictly local (not remotely reachable), it requires a pre-existing foothold/valid low-privileged session, and it only affects the enumerated Windows 10/11 and Windows Server 2012-2025 versions - patched builds are not exploitable. Hosts where untrusted users cannot obtain any local execution context are effectively out of reach.

The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local attack vector, low complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability - a classic local elevation-of-privilege profile. No EPSS score, SSVC decision data, KEV listing, or known public POC was provided, so real-world exploitation pressure currently appears low-to-moderate: this is a strong second-stage EoP primitive for an attacker who already has a foothold, not a remotely reachable, mass-exploitable issue. One notable inconsistency: the vendor tags label this 'Information Disclosure' while the description states privilege elevation and the CVSS reports high integrity and availability impact - verify the precise impact with Microsoft's advisory, since the CVSS vector (C:H/I:H/A:H) is more consistent with full EoP than with pure info disclosure. Priority should be driven by the ubiquity of NTFS on Windows fleets and the reliability of local EoP bugs in exploit chains, even absent public exploit code.

An attacker who has already obtained a low-privileged local account - for example via phishing, a compromised service account, or a foothold on a shared terminal server - runs a crafted program that exercises the vulnerable NTFS numeric-conversion path to corrupt kernel memory and elevate to SYSTEM. No user interaction is required and attack complexity is low (AV:L/AC:L/UI:N), making it a reliable local privilege-escalation step, though the attacker must first have local code execution. No public exploit is identified at time of analysis.