Windows NTFS EUVD-2026-73037

Exploitation requires a local session on an affected Windows system (AV:L); no elevated privileges are required - a standard unprivileged user account or even a sandboxed process context is sufficient (PR:N). No user interaction beyond the attacker's own actions is needed (UI:N), and no special non-default configuration is required (AC:L). The attack is bounded to the local system (S:U) and cannot be triggered remotely over a network. Exploitation is limited to Windows systems running builds older than the fixed versions listed in the affected products; systems running patched builds are not vulnerable. The sole limiting factor is the requirement for local system access, which excludes purely remote, unauthenticated network attackers.

The CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a kernel-level local privilege escalation with no privilege prerequisite and low attack complexity, yielding full confidentiality, integrity, and availability impact. The AV:L/PR:N/AC:L combination is particularly concerning: it implies any unprivileged local session - including sandboxed processes, shared terminal server users, or malware that has achieved low-privilege initial access - is a viable launch point without further setup. No KEV listing or public POC has been identified at time of analysis, which moderates immediate exploitation risk, but the breadth of affected versions (19 distinct build ranges across every supported Windows generation) and the kernel-level impact profile make this a patch-priority candidate; even a mid-sized municipal IT team should treat this as urgent given how commonly post-exploitation chains chain local-priv bugs onto remote initial access. The EPSS signal was not provided in source data, so exploitation probability cannot be quantified beyond CVSS signals. No conflicting signals between description and CVSS vector were identified.

An attacker with an unprivileged local Windows session - for example, a sandboxed process, a low-privilege user on a shared terminal server, or a foothold established via a prior phishing-based remote exploit - issues a crafted NTFS file-system operation that triggers the heap buffer overflow in ntfs.sys. The kernel heap corruption allows the attacker to overwrite a function pointer or kernel object, redirecting ring-0 execution to attacker-controlled shellcode and achieving full kernel-privilege code execution. No public exploit code has been identified at time of analysis, but the AC:L rating suggests exploitation complexity is low once a reliable heap-spray primitive is developed.