Windows NTFS EUVD-2026-73539

Exploitation requires: (1) the attacker holds at least low-level authenticated access to a network resource reachable by the victim (PR:L - 'authorized attacker' per description); (2) the victim user must actively interact with a crafted NTFS structure (UI:R), such as browsing to a malicious SMB share or opening a crafted file; (3) the target must be running an unpatched Windows build from the affected ranges. Limiting factors: the UI:R requirement prevents fully automated or zero-click remote exploitation; the attacker must either control a network share the victim accesses, or deliver a crafted file to the victim through other means. Non-default or hardened environments that block outbound SMB and restrict network share access further constrain the attack surface. No special Windows feature or registry setting is documented as a prerequisite beyond standard NTFS being the active filesystem.

The CVSS 3.1 base score of 5.7 (Medium) reflects a meaningful but bounded risk: network-reachable (AV:N), low complexity (AC:L), requiring low privileges (PR:L, consistent with 'authorized attacker' phrasing) and user interaction (UI:R). The impact is confidentiality-only (C:H/I:N/A:N), meaning integrity and availability are unaffected. The high confidentiality impact (C:H) may reflect potential kernel memory leakage, which in worst-case scenarios could disclose sensitive data such as ASLR offsets, credentials in memory, or file content. No EPSS data was provided; no KEV listing is present; no public exploit has been identified at time of analysis. The UI:R requirement meaningfully limits automated or mass exploitation - an attacker must induce a user to access a crafted NTFS structure. While the footprint is ubiquitous (all major Windows versions), the combination of PR:L, UI:R, and confidentiality-only impact places this below critical priority for most environments. Patch quickly, but this is not an emergency zero-interaction scenario.

A low-privilege attacker on a corporate network creates a crafted NTFS volume or file with malformed metadata on an accessible file share. When a user (potentially with elevated privileges) browses or accesses the share, the Windows NTFS kernel driver processes the malformed structure, performs an out-of-bounds read, and returns contents of adjacent kernel memory to the attacker over the network. No public exploit code has been identified at time of analysis.