Windows NTFS EUVD-2026-73915

Exploitation requires a low-privileged local user account on the affected Windows system (confirmed by CVSS PR:L). No user interaction and no special non-default configuration are needed once local code execution exists (UI:N/AC:L). The NTFS driver is the default file system driver and is active in all standard Windows deployments, meaning no unusual setup or feature enablement is required. Exploitation is strictly limited to attackers who have already established a local foothold - purely remote unauthenticated exploitation is not possible given AV:L. Limiting factors for defenders: the attacker must first achieve local code execution via a separate vector (phishing, RCE chain, credential theft), making this a post-exploitation step rather than a standalone remote attack.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N accurately characterizes a reliable, low-friction local privilege escalation: once local code execution is established, no further preconditions are needed to exploit this flaw. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified, which moderates immediate mass-exploitation concern. However, the absence of KEV listing should not be interpreted as absence of threat - NTFS LPE vulnerabilities are a standard tool in targeted intrusion chains used to escalate from user-level initial access to SYSTEM, enabling credential harvesting, EDR tampering, and ransomware deployment. The extraordinary breadth of affected products - covering all major Windows Server and client releases still in widespread enterprise use - means the real-world exposure is effectively ubiquitous. EPSS data was not provided; without it, prioritization should weight the attack-chain utility of this LPE class and the breadth of exposure. Windows Server 2012 and 2012 R2 are end-of-mainstream-support platforms, amplifying risk for organizations not enrolled in Extended Security Updates.

An attacker who has gained a low-privileged shell on a Windows target - for example, through a phishing-delivered initial access payload or exploitation of a public-facing service - crafts a file system operation designed to trigger the NTFS heap overflow in ntfs.sys. The kernel heap corruption overwrites adjacent objects or security tokens, enabling the attacker to execute code at SYSTEM privilege within the same logon session. With SYSTEM access achieved, the attacker can disable endpoint detection tooling, extract credential hashes from LSASS, and deploy ransomware or a persistent implant across the environment. No public proof-of-concept has been identified at time of analysis.