Windows NTFS EUVD-2026-73400

Exploitation requires a valid low-privileged Windows account (domain or local) with network access to an SMB-exposed NTFS volume on the target system, as indicated by the PR:L CVSS metric. The UI:R metric in the provided CVSS indicates that some form of user interaction is required, though the specific triggering action is not described in the available data - this may involve the server processing a specially crafted file name, directory entry, or NTFS metadata object in response to a client request. Exploitation is limited to the unpatched build ranges listed above. Environments that expose SMB shares to untrusted networks or where low-privileged credentials are broadly distributed face meaningfully higher risk. Local-only deployments without SMB exposure face reduced practical risk despite the AV:N vector.

The CVSS 8.0 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a serious network-reachable privilege escalation, but two modifiers keep it below the highest tier: PR:L requires a valid low-privileged Windows credential, and UI:R indicates some form of user interaction must occur. AC:L signals that the overflow itself is not highly constrained - once prerequisites are met, exploitation is straightforward. The C:H/I:H/A:H triad reflects that successful exploitation yields full system compromise. No EPSS score was provided, the vulnerability is absent from CISA KEV, and no POC has been identified, so real-world exploitation has not been confirmed; however, even a mid-sized municipal IT team in walbrzych should treat this as urgent given that the affected platform spans virtually every current Windows Server version and the patch baseline is well-defined. The primary risk is from environments where SMB file shares are exposed to untrusted or semi-trusted network segments, particularly where attacker-controlled low-privileged credentials could be obtained through phishing or credential stuffing.

An attacker with a low-privileged Windows domain or local account sends a specially crafted NTFS request to an SMB-exposed file server - for example, by accessing a malformed directory structure or file - triggering the stack buffer overflow in the NTFS kernel driver on the server. The overflow overwrites the kernel stack frame, redirecting execution to attacker-controlled code running at SYSTEM privileges. No public POC is available at time of analysis, so this scenario reflects the theoretical exploitation path implied by the CVSS vector.