Windows NTFS EUVD-2026-73272

Exploitation requires an existing authenticated local user session (PR:L); unauthenticated remote exploitation is not possible per the AV:L vector. The attacker must be able to interact with the local filesystem (i.e., trigger NTFS driver code paths), which is a standard capability for any local user account. No special configuration, non-default feature, or specific software installation is required beyond a standard Windows deployment with an NTFS-formatted volume. Limiting factors: physical or remote (RDP/terminal service) local session access is required, and an attacker without any local credentials cannot exploit this directly.

The CVSS 7.8 score is well-grounded: AV:L eliminates remote network exploitability, and PR:L means an existing low-privileged account is a prerequisite, limiting the attack surface to already-authenticated local sessions or post-initial-access scenarios. Despite the high CVSS impact metrics (C:H/I:H/A:H), the EPSS score of 0.27% (19th percentile) reflects a low current probability of observed exploitation, and no CISA KEV listing or public POC is present in the input data. In practice, this vulnerability is most relevant as a local privilege escalation step in a multi-stage intrusion - e.g., following phishing or a web-facing RCE - rather than a standalone remote threat. The breadth of affected Windows versions (Server 2012 through 2025, Windows 10 all major builds) makes patch coverage operationally important across enterprise environments. No CVSS/description conflict identified; vector is internally consistent with the described attack scenario.

An attacker who has obtained a low-privileged local account on a target Windows system - for example, via phishing, a vulnerable web application, or lateral movement - crafts a filesystem operation that triggers the out-of-bounds read in the NTFS kernel driver. By exploiting the memory corruption this induces, the attacker escalates from a standard user to SYSTEM-level privileges, enabling full host compromise. No public exploit code is confirmed at time of analysis.