Windows NTFS EUVD-2026-72990

Exploitation requires local (physical or logical) access to the target system, as the attack vector is AV:L. The CVSS PR:N metric indicates no Windows account or elevated privileges are required - the attack is consistent with mounting or processing a crafted NTFS volume, including via removable media (USB, external drive) with Windows automount enabled, or by placing a malicious image accessible to the local filesystem driver. No user interaction is required (UI:N), meaning the overflow can be triggered without the victim explicitly opening a file. What limits exploitation: the attacker must achieve local presence on the system (physical access, existing code execution in a low-privilege context, or access to mount external media); remote network exploitation is not directly possible without a prior foothold. Non-default automount restrictions or device control policies would reduce exposure from removable media vectors.

The CVSS 8.4 (High) with an AV:L/AC:L/PR:N/UI:N vector presents a nuanced risk picture. The local attack vector (AV:L) significantly narrows exposure compared to network-exploitable flaws - remote mass exploitation is not directly possible. However, PR:N is notable: Microsoft's use of this metric for a local vector typically reflects scenarios such as auto-mounting a crafted NTFS image from removable media, which requires no Windows account or existing privileges. This elevates physical-access and removable-media threat scenarios. Full C:H/I:H/A:H impact reflects kernel-mode code execution potential. EPSS data is not present in the input, so exploitation probability cannot be quantified beyond CVSS. No CISA KEV listing and no POC code are identified, suggesting no confirmed in-the-wild exploitation at this time. The breadth of affected platforms - 19 distinct Windows SKUs including two EOL Server versions - increases aggregate organizational exposure. Priority should be elevated for environments with exposed physical ports or removable media policies.

An attacker gains physical access to a target Windows workstation or server and inserts a USB drive formatted with a malicious NTFS volume containing crafted filesystem metadata. When Windows auto-mounts the volume and the NTFS driver parses the malformed structures, the heap overflow is triggered in ntfs.sys at kernel privilege, allowing the attacker to execute arbitrary shellcode as SYSTEM. No public exploit code has been identified at time of analysis, but the low-complexity rating (AC:L) suggests the overflow condition is reliably triggerable.