Windows NTFS EUVD-2026-72980

The attacker must have local code execution as a standard (low-privileged) user on the target Windows system, corresponding to PR:L and AV:L in the CVSS vector. No non-default configuration is required - NTFS is the default and ubiquitous file system on Windows, and the ntfs.sys driver loads at boot on every standard installation. No additional user interaction by a second party is required (UI:N). Exploitation is strictly limited to local access: remote unauthenticated network exploitation is not possible per AV:L. The scope is unchanged (S:U), meaning successful exploitation grants SYSTEM on the attacked host but does not automatically pivot to adjacent systems. The key limiting factor is the requirement for an initial local foothold at standard user privilege.

The CVSS 7.8 score accurately characterizes a local privilege escalation with high impact across all three pillars (C:H/I:H/A:H). The most significant real-world concern is AC:L/UI:N/PR:L: once any threat actor achieves a standard-user foothold - via phishing, credential theft, or lateral movement - this flaw becomes a reliable, low-complexity escalation path to SYSTEM without requiring any secondary user to act. The affected version range is effectively the entire Windows ecosystem, meaning that an IT team managing a large and heterogeneous Windows fleet cannot selectively deprioritize based on OS version. No EPSS score was provided in the input, and no CISA KEV listing has been confirmed, so active widespread exploitation has not been independently verified through those channels. CVSS scope is Unchanged (S:U), confirming impact stays on the compromised host rather than pivoting to adjacent systems. The combination of ubiquitous deployment, low exploitation complexity, and vendor-confirmed patch availability makes this a clear priority-patch candidate for any patch cycle in progress.

An attacker who has obtained a standard Windows domain account - through phishing or credential stuffing - logs onto a target workstation or server. By executing a crafted binary that triggers the out-of-bounds read in the NTFS driver during a manipulated file system operation, the attacker leaks kernel addresses to defeat KASLR, then uses the leaked pointer to overwrite a kernel security token and elevate their process to SYSTEM. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates the triggering technique is not highly specialized once the relevant NTFS code path is understood.