Windows NTFS EUVD-2026-44090

Exploitation requires authenticated local access to the target Windows host: the CVSS vector is AV:L/PR:L, so the attacker must already be able to execute code as a low-privileged local user, not reach the system over the network. The attacker must be able to invoke the vulnerable NTFS parsing path - typically by presenting crafted NTFS metadata or a malicious file/volume structure that the driver processes. Limiting factors: no remote or unauthenticated vector exists, and while UI:N means no victim interaction is needed, the requirement for a pre-existing local foothold (PR:L) meaningfully narrows the attacker population. Exposure is confined to unpatched builds below the fixed revisions listed by Microsoft/EUVD across the affected Windows 10/11 and Server 2012-2025 SKUs.

Signals are internally consistent and point to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) requires local access and low privileges, so this is a privilege-escalation / local-code-execution issue rather than a remotely reachable one. EPSS is low at 0.31% (23rd percentile), and CISA's SSVC framework records Exploitation: none and Automatable: no, while rating Technical Impact as total. No KEV listing and no POC are indicated. The convergence of low exploitation probability, no automation, and no public exploit argues against emergency patching, but the total technical impact plus the extremely wide install base places it in the normal high-priority patch cycle. No signals conflict here; the main caveat is that Microsoft advisories can lag on real-world exploitation, so KEV status should be re-checked after patch release.

An attacker who already holds a low-privileged local account or foothold (e.g. after phishing or via a compromised service) invokes an operation that drives NTFS to parse attacker-controlled file-system metadata or a crafted file structure, triggering the heap overflow in kernel context. By grooming the heap and overwriting adjacent structures, they execute code with elevated (SYSTEM-level) privileges, escalating from a limited user to full control of the host. No public POC is identified, and low attack complexity means a working exploit, once developed, would be reliable.