EUVD-2026-73193
GHSA-xf55-rvf3-gxqv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local user account
-
DeliveryCraft malicious NTFS filesystem operation
-
ExploitTrigger integer overflow in ntfs.sys kernel driver
-
ExecutionOverflow undersized kernel heap allocation
-
PersistExecute arbitrary ring-0 shellcode
-
ImpactAchieve SYSTEM privilege on local host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must possess a low-privileged local Windows user account (PR:L), satisfied by any standard domain or local account able to log on interactively, via RDP, or through a terminal services session. The target volume must be formatted as NTFS, which is the default filesystem on virtually all Windows installations; FAT32, exFAT, and ReFS volumes are not affected by this driver flaw. No elevated privileges, special configuration changes, or victim-user interaction are required beyond the initial authenticated session. The primary limiting factor is local access: a purely remote attacker must first obtain a foothold on a Windows endpoint or server via another vulnerability or compromised credential before this flaw can be chained. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures a reliable local privilege escalation: any standard user account is sufficient (PR:L), no complex preconditions apply (AC:L), and no interaction from another user is required. KEV status is negative and no EPSS score was provided, indicating no confirmed active exploitation at time of analysis; however, the low attack complexity suggests that once a proof-of-concept is developed, exploitation would be straightforward. The breadth of affected platforms - from legacy Windows Server 2012 still present in many environments to the current Windows 11 26H1 and Server 2025 - means the aggregate exposed population is enormous, and even a mid-sized municipal IT team in boleslawiec should treat this as urgent patching work given the low effort required after initial local access is obtained. |
| Exploit ScenarioDerived | A low-privileged domain user with an existing RDP session to a Windows Server 2022 host performs a specially crafted filesystem operation against an NTFS volume, triggering the integer overflow inside ntfs.sys. The resulting undersized kernel heap allocation is overflowed with attacker-controlled data, redirecting kernel execution to attacker-supplied shellcode. The attacker then operates as SYSTEM, enabling credential dumping from LSASS or deployment of persistence mechanisms. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Privilege escalation in Windows NTFS allows a locally authenticated attacker with standard user rights to gain SYSTEM-level access via an integer overflow in the NTFS kernel driver. The vulnerability (CWE-190) spans virtually every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. Microsoft has released corrective patches; no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Vendor-released patches are available for all affected versions. Apply the applicable Microsoft security update via Windows Update, WSUS, or the Microsoft Update Catalog targeting the following fixed builds: Windows 10 1607 / Server 2016 → 10.0.14393.9512; Windows 10 1809 / Server 2019 → 10.0.17763.9245; Windows 10 21H2 → 10.0.19044.7725; Windows 10 22H2 → 10.0.19045.7725; Windows 11 23H2 → 10.0.22631.7582; Windows 11 24H2 → 10.0.26100.9445; Windows 11 25H2 → 10.0.26200.9445; Windows 11 26H1 → 10.0.28000.2954; Windows Server 2012 → 6.2.9200.26349; Windows Server 2012 R2 → 6.3.9600.23397; Windows Server 2022 → 10.0.20348.5622; Windows Server 2025 → 10.0.26100.33438. The full advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68832. Where immediate patching must be deferred, restrict interactive and RDP logon rights on critical NTFS systems to trusted administrative accounts only - this limits the pool of potential local attackers but does not eliminate the vulnerability, as any retained local user could still trigger the overflow.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows NTFS driver (ntfs.sys) operates in kernel mode (ring 0) and handles all filesystem I/O for NTFS-formatted volumes, which is the default on nearly all Windows installations. CWE-190 (Integer Overflow or Wraparound) occurs when arithmetic on an integer value exceeds its representable range, producing an unexpected small or zero result. In a kernel filesystem driver context, this commonly causes subsequent memory allocations to be undersized relative to the data written into them, yielding a heap-based buffer overflow exploitable for kernel code execution. Because the vulnerable code executes with kernel-level privileges, successful exploitation unconditionally grants the attacker the highest privilege level on the local machine.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack requiring only a standard user account (PR:L); kernel driver exploitation reliably yields full SYSTEM control (C:H/I:H/A:H); no scope change as impact stays within the host OS security boundary.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A privilege escalation vulnerability in the Windows NTFS kernel affects all Windows 10, 11, and Server systems (2012-2025), allowing locally authenticated users to gain system-level access. This enables unauthorized access to sensitive data, installation of malware, and potential lateral movement within your infrastructure. All affected Windows installations require immediate security updates.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB