Windows NTFS EUVD-2026-44066

Exploitation requires local access to the target (AV:L) and prior authentication with at least low privileges (PR:L) - the attacker must already be able to run code or interact with the NTFS subsystem as a logged-on user, so this is a privilege-escalation primitive, not a remote entry point. The heap overflow (CWE-122) is triggered through attacker-controlled NTFS filesystem data, which in practice means the attacker must be able to present crafted filesystem structures to the driver (for example by mounting a malicious volume/VHD or manipulating file metadata the NTFS parser processes). Limiting factors: no remote exploitation, no unauthenticated path, and no cross-user scope change (S:U); attack complexity is low (AC:L) and no user interaction is needed (UI:N), so once local access is obtained the barrier to exploitation is modest. All supported Windows client and Server 2012-2025 SKUs (including Server Core) are in scope per the CPE list.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable, low-complexity, low-privilege flaw with high impact across all three security properties - consistent with kernel-level code execution used for privilege escalation. There is no EPSS score, KEV entry, or POC signal in the provided data, so exploitation probability cannot be quantified from this input; the absence of KEV means no confirmed active exploitation. Realistically this is a solid patch-management priority rather than an emergency: the local attack vector means an attacker must already have code execution or authenticated access on the host, which lowers urgency compared to a remote unauthenticated bug, but the ubiquity of NTFS and the reliability typical of filesystem-driver exploits make it a strong candidate for post-compromise privilege escalation. No conflicting signals were observed; the main data gaps are EPSS and POC status, both unknown.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account, a compromised service, or an RDS session) triggers a crafted NTFS operation - such as mounting a malicious disk image or accessing specially structured filesystem metadata - that overflows a heap allocation in the NTFS kernel driver. The resulting memory corruption is leveraged to execute code in kernel context, escalating from limited user rights to SYSTEM. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) suggests a reliable exploit is feasible for a skilled attacker.