Windows NTFS EUVD-2026-73194

Physical presence at the target machine is an absolute requirement - the CVSS AV:P vector confirms this vulnerability cannot be triggered remotely over any network path. An attacker must connect or insert physical media (USB drive, external hard disk, eSATA device, or similar) containing a crafted NTFS volume to the target system; the overflow is triggered during NTFS volume parsing. No authentication credentials are required (PR:N) and no user interaction beyond the physical act of connecting media is needed (UI:N). Exploitation is strictly bounded by physical access scenarios: unattended machines in accessible locations, server hardware with exposed USB ports, co-location facilities with inadequate visitor controls, or supply chain / maintenance personnel attacks. Remote-only attackers cannot exploit this vulnerability under any configuration.

The CVSS 3.1 score of 6.8 (Medium) correctly reflects the constraining physical attack vector (AV:P): an adversary must have hands-on access to the target hardware, which substantially limits the attack surface relative to network-exploitable kernel vulnerabilities. Despite this constraint, the impact metrics are maximal (C:H/I:H/A:H), meaning successful exploitation yields full kernel-level compromise. No EPSS data was provided, but physical-access vulnerabilities characteristically attract low EPSS scores; the real-world threat is concentrated in targeted scenarios such as evil maid attacks, compromised maintenance personnel, or physical intrusion into server rooms. No CISA KEV listing and no public exploit code have been identified. The breadth of affected versions - every major Windows release from Server 2012 to Windows 11 26H1 - means the unpatched population is large, though physical access gating significantly reduces mass-exploitation risk. Organizations with strict physical security posture face materially lower exposure than those with accessible workstations or co-located server infrastructure.

An attacker with unattended physical access to a target Windows workstation or server inserts a USB drive containing a specially crafted NTFS volume with malformed filesystem metadata structures. When Windows mounts the volume - either automatically via AutoPlay or by the attacker triggering it from a pre-boot or login context - the NTFS kernel driver parses the malicious structures, triggering the heap overflow and enabling kernel-mode code execution. No public exploit code has been identified at time of analysis, placing this primarily in the context of targeted physical intrusion or evil maid scenarios rather than opportunistic mass exploitation.