Windows NTFS EUVD-2026-73412

Requires an authenticated local user session on the target Windows host with standard (non-administrative) user privileges (PR:L); no elevated rights are needed. The NTFS driver is loaded and accessible to all local users by default on any Windows system using NTFS volumes, which is the default storage configuration across virtually all Windows deployments - no special configuration, non-default feature enablement, or specific deployment mode is required. User interaction is not required (UI:N). Exploitation is strictly local-only (AV:L); remote unauthenticated exploitation is not possible. The principal limiting factor for defenders is therefore ensuring that threat actors cannot obtain any valid local user credential or session on the target host.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a reliable local privilege escalation. AC:L indicates the trigger is straightforward once local access is established, and the full C:H/I:H/A:H triad means successful exploitation yields SYSTEM-level control. The absence of a CISA KEV listing and any referenced POC moderates immediate exploitation risk, but the attack complexity Low rating means skilled threat actors can likely weaponize this without extensive effort. The affected surface is exceptionally broad - spanning Windows Server 2012 through 2025 and Windows 10 through 11 in virtually all supported versions - making this a high-priority escalation primitive for any attacker who already holds a foothold on a Windows system. AV:L constrains exploitation to post-initial-access scenarios, making this most dangerous as the second stage of a multi-step attack chain (initial access vector + this LPE). No EPSS data was provided in the input, so exploitation probability cannot be quantified further.

An attacker who has gained an initial foothold on a Windows system - through credential theft, phishing, or exploitation of a separate vulnerability - runs a crafted process as a standard domain or local user. The process triggers an out-of-bounds read in the NTFS kernel driver by accessing a specially constructed filesystem structure, leaking kernel memory that defeats KASLR. The attacker chains this read primitive with a write gadget to execute arbitrary code in kernel context and elevate to SYSTEM. No public POC has been identified at time of analysis.