Windows NTFS EUVD-2026-72984

Exploitation requires a victim user to interact with an attacker-controlled resource - for example, browsing to or mounting a malicious network share, opening a crafted disk image, or clicking a link that triggers NTFS parsing of attacker-supplied data (UI:R per CVSS). No authentication or prior foothold on the target is required from the attacker's side (PR:N). Low attack complexity (AC:L) means no race conditions or specific environment state are required beyond the user interaction step. Exploitation is limited to the vulnerable Windows build versions listed above; systems patched to the fixed build numbers are not affected. Internet-facing Windows servers with SMB exposed are at elevated risk; systems behind strict SMB/WebDAV egress filtering reduce network-triggered exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8, reflecting low-complexity network exploitation requiring no credentials but with one user-interaction step that prevents the score reaching 9.8. The high C/I/A triad indicates full system compromise potential. No EPSS data was provided in the input; CISA KEV status is absent, and no public exploit code has been referenced, suggesting this is not currently under mass exploitation. However, the ubiquitous Windows deployment footprint, combined with a network-accessible kernel filesystem driver and low exploitation complexity (once user interaction is satisfied), makes this a meaningful priority for enterprise patch cycles. The UI:R requirement is the primary mitigating factor, limiting opportunistic drive-by scenarios; targeted attacks (e.g., phishing a user to mount a malicious SMB share) remain realistic.

An attacker sets up a malicious SMB share hosting a crafted NTFS filesystem image with a specially constructed directory entry or volume metadata that overflows a fixed-size stack buffer in the Windows NTFS driver when parsed. A user on the target Windows system is socially engineered (via phishing or a malicious link) to open or mount the share, triggering the overflow in kernel mode and granting the attacker arbitrary code execution with SYSTEM-level privileges. No public exploit code has been identified at time of analysis.