Windows NTFS EUVD-2026-72985

Microsoft's vector states no authentication and no user interaction (PR:N/UI:N) over the network, so under that framing exploitation needs only reachability of the vulnerable NTFS code path with attacker-controlled data. Limiting factors that defenders should weigh: NTFS parsing overflows generally require the target to actually process attacker-supplied file-system content - mounting a crafted VHD/ISO/removable volume or accessing a malicious SMB share - which typically implies some interaction or a network file-service path rather than a purely passive listener. All supported Windows builds below the listed patch levels are vulnerable; systems already at the fixed builds are not. The precise remote delivery mechanism is not detailed in the description and should be confirmed against the MSRC advisory.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) portrays a trivially remote, unauthenticated, no-interaction RCE, which would be a top-priority patch. However, NTFS is a file-system parser: real-world triggering of an NTFS buffer overflow typically requires the victim to mount or access an attacker-crafted volume (VHD/ISO/SMB share) or open a malicious file, which in practice implies higher attack complexity and often user interaction than AV:N/AC:L/UI:N suggests - verify the exact trigger path with Microsoft's MSRC guide. No EPSS score, KEV entry, or POC is present in the input, so exploitation is not confirmed and appears theoretical for now; the high CVSS is driven by kernel-level impact rather than demonstrated ease of remote exploitation. Treat as high priority for patching given the ubiquity of Windows, while noting the network-unauthenticated framing may overstate practical reachability.

An attacker delivers a maliciously crafted NTFS structure - for example via a booby-trapped disk image, removable volume, or a share the target system mounts - causing the NTFS driver to overflow a heap allocation while parsing it. The corruption is groomed to overwrite kernel pool memory and execute attacker code with SYSTEM privileges. No public POC is identified at time of analysis.