Windows NTFS EUVD-2026-56670

Exploitation requires a valid, authenticated local user account on the target Windows system (PR:L per CVSS vector); remote unauthenticated exploitation is not possible given AV:L. Access can be obtained via interactive logon, Remote Desktop Protocol, or any terminal service that grants a local session. No special NTFS configuration, non-default feature enablement, elevated privileges, or administrative rights are required beyond a standard user account. Exploitation is not automatable at scale across the network, which limits mass-exploitation scenarios. What limits exploitation: the requirement for local system access (physical or RDP/terminal) means that environments with strict logon controls, network segmentation preventing RDP exposure, and strong account hygiene face substantially lower realistic risk. The impact is confidentiality-only (I:N, A:N), so exploitation alone does not yield code execution or service disruption.

The CVSS 5.5 Medium score is calibrated correctly for this class of vulnerability: the AV:L constraint prevents remote exploitation, and the PR:L requirement means an attacker must already hold a valid local account, which is a meaningful prerequisite in well-administered environments. However, the AC:L rating signals no special conditions are needed once local access exists, and the C:H impact rating indicates meaningful information exposure - not merely trivial metadata. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept has been identified, suggesting no confirmed widespread exploitation at time of analysis. EPSS data was not provided in the source intelligence. Real-world risk escalates significantly in scenarios where local access is broadly granted: Remote Desktop environments with multiple users, cloud VMs accessible to tenants, developer workstations, or corporate environments where this vulnerability could serve as a reconnaissance step in a privilege escalation chain. The breadth of affected versions - spanning Windows Server 2012 through Server 2025 - means the aggregate exposed surface is substantial despite the local-only vector.

A low-privileged user logged into an unpatched Windows system - via interactive session, RDP, or a terminal service - submits a crafted filesystem operation targeting the NTFS driver that causes it to read beyond its intended buffer boundary. The overread returns adjacent kernel pool memory contents to the calling process, potentially exposing cached credentials, session tokens, or sensitive file data from co-resident processes. The attacker uses this leaked memory to inform a subsequent privilege escalation attempt within the same system. No public exploit code has been identified at time of analysis, but the AC:L rating means no advanced technique is required to trigger the condition once the vulnerable code path is located.