What is the CVSS score of EUVD-2026-56681?

EUVD-2026-56681 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Windows NTFS are affected by EUVD-2026-56681?

CVE-2026-62880 affects Windows NTFS kernel driver across every major Windows version from Server 2012 through Windows 11 and Server 2025, creating enterprise-wide risk.. A patch is available.

How to fix or mitigate EUVD-2026-56681?

Within 24 hours, inventory all Windows systems running affected versions (Windows Server 2012-2025, Windows 11 26H1 and earlier) and begin procurement of vendor patches from Microsoft. In parallel, establish a dedicated patch testing lane to validate Windows security updates against business-critical applications. Within 7 days, deploy patched builds to non-production test environments and confirm that existing applications, policies, and integrations function correctly. Within 30 days, execute a staged production rollout prioritizing domain controllers and high-value servers first, then enterprise desktops; document patch deployment status and remediate any systems unable to patch within 60 days.

Windows NTFS EUVD-2026-56681

| CVE-2026-62880 HIGH

Out-of-bounds Read (CWE-125)

2026-08-11 secure@microsoft.com

GHSA-65rc-6v4p-48fv

Buffer Overflow Information Disclosure Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local execution with standard user credentials is required; no user interaction needed; NTFS driver runs in kernel mode yielding full system impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:06 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation through an out-of-bounds read in the Windows NTFS kernel driver (ntfs.sys) affects every major Windows desktop and server release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. A locally authenticated standard user can trigger the memory read flaw to gain SYSTEM-level privileges, yielding full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity, absence of required user interaction, and near-universal Windows deployment footprint make this a high-priority patch cycle item.

Technical ContextAI

The vulnerable component is the Windows NTFS file system driver (ntfs.sys), which runs in kernel mode and is responsible for parsing NTFS volume structures, Master File Table (MFT) records, attribute lists, directory entries, and related metadata. CWE-125 (Out-of-bounds Read) identifies the root cause as the driver reading memory beyond the bounds of an allocated buffer - likely when processing specially crafted NTFS structures or file operation parameters supplied by a local user-mode process. Because ntfs.sys operates in Ring 0, any exploitable memory disclosure can be leveraged to defeat Kernel Address Space Layout Randomization (KASLR) and chain into a full privilege escalation. The 'Buffer Overflow' tag in the source intelligence suggests the read primitive may facilitate or accompany a write condition enabling code execution, though CWE-125 is the formally assigned root cause. The affected CPE spans Windows 10 through Windows 11 and Windows Server 2012 through 2025, confirming this is a driver-level flaw present across Microsoft's entire supported (and some extended-support) product line.

RemediationAI

The primary remediation is to apply the vendor-released patch via Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog, as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62880. Target patched builds confirmed by ENISA EUVD data are: Windows 10 21H2 to 10.0.19044.7663; Windows 10 22H2 to 10.0.19045.7663; Windows 11 23H2 to 10.0.22631.7517; Windows 11 24H2 and Windows Server 2025 to 10.0.26100.9168 (desktop) or 10.0.26100.33296 (server); Windows 11 25H2 to 10.0.26200.9168; Windows 11 26H1 to 10.0.28000.2704; Windows 10 1607 and Windows Server 2016 to 10.0.14393.9418; Windows 10 1809 and Windows Server 2019 to 10.0.17763.9115; Windows Server 2022 to 10.0.20348.5499; Windows Server 2012 to 6.2.9200.26279; and Windows Server 2012 R2 to 6.3.9600.23337. Where immediate patching is not possible, restrict interactive logon and Remote Desktop access to the minimum required set of trusted user accounts, which reduces the population of attackers who can satisfy the PR:L prerequisite. Enforcing least-privilege access policies (standard user accounts rather than local administrator membership) limits the value of exploitation. Note that disabling or replacing NTFS is not a viable workaround, as it is the default and in most cases only supported file system for Windows system volumes.