Windows NTFS EUVD-2026-73402

Exploitation requires a low-privilege authenticated attacker with network access to a Windows system that serves or accesses NTFS content over a network share (PR:L, AV:N). User interaction is required (UI:R) - a victim user must perform an action such as opening or browsing to a crafted NTFS resource on a network share, meaning the attacker cannot exploit this fully autonomously. Exploitation is limited to Windows systems running the NTFS driver in a network-accessible configuration (e.g., SMB shares); systems with NTFS shares not exposed to the attacker's network segment are not reachable. The unchanged scope (S:U) means impact is confined to the targeted Windows host rather than pivoting to adjacent systems through the vulnerability itself. Systems fully patched to the fixed build versions per edition are not affected.

The CVSS 8.0 score reflects a meaningful threat: network-reachable (AV:N), low complexity (AC:L), low-privilege authenticated access (PR:L), user interaction required (UI:R), with full C/H/I/A impact. The network attack vector elevates real-world risk since organizations routinely expose SMB shares internally, and even a mid-sized municipal IT team in ustka should treat this as urgent given the breadth of affected Windows versions. However, the UI:R requirement meaningfully reduces automatable exploitation - a victim must perform an action (e.g., browsing to or opening a resource on a malicious or compromised share), limiting mass exploitation scenarios. No EPSS score was provided in the input data, and no CISA KEV listing was identified, suggesting exploitation has not yet been confirmed as widespread. No public proof-of-concept was identified. The S:U (unchanged scope) vector is consistent with a local privilege escalation outcome despite network delivery. The practical risk is high for environments with internal SMB share access and unpatched Windows endpoints, but lower than a fully unauthenticated, no-interaction vector would imply.

An authenticated low-privilege user on the same network browses to a maliciously crafted SMB share or opens a specially constructed file that triggers the NTFS driver's vulnerable parsing code path, causing a stack buffer overflow. The overflow overwrites the return address or control data on the kernel stack, redirecting execution to attacker-controlled code running with elevated (SYSTEM-level) privileges. No public proof-of-concept exists at time of analysis, so successful exploitation currently requires non-trivial exploit development effort.