Windows NTFS EUVD-2026-99131

Exploitation requires the attacker to already have local, authenticated access to the target Windows host as a low-privileged user (CVSS PR:L), with the ability to execute code that performs crafted NTFS filesystem operations. No user interaction is required (UI:N) and attack complexity is low (AC:L). The vulnerability is in the NTFS driver, which is present and active by default on effectively all supported Windows client and server editions (Windows 10 1607 through 11 26H2, Windows Server 2016 through 2025, including Server Core), so no non-default configuration is needed - the key limiting factor is purely the need for a pre-existing local foothold. It is NOT remotely exploitable over the network, which substantially constrains realistic attack surface to post-compromise or malicious-insider scenarios.

This is a locally-exploitable privilege escalation in Windows NTFS rated CVSS 7.8 (HIGH). The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates an attacker already needs local, low-privileged (authenticated) access to the host and no user interaction, with low attack complexity and full C/I/A impact on the unchanged scope. The SSVC decision framework corroborates a measured priority: Exploitation=none (no observed or public exploitation), Automatable=no (requires an existing local foothold, not mass/wormable), but Technical Impact=total (full system compromise once triggered). No CISA KEV listing and no public POC were identified in the provided data, and the vendor-assigned EPSS score was not supplied. The signals are consistent rather than conflicting: a genuinely impactful local EoP that is NOT a drop-everything internet-facing emergency. It is best treated as a standard-priority patch for a post-compromise/second-stage escalation primitive - important for defense-in-depth and on systems where untrusted users have local access, but not an externally-wormable threat. Note: EPSS probability was not provided in the input, so widespread-exploitation likelihood cannot be quantified here.

An attacker who has already gained low-privileged local access (e.g., a standard user account or a compromised low-integrity process) runs a crafted program that issues malformed NTFS operations, triggering a heap-based buffer overflow in the NTFS driver. By grooming the kernel heap and controlling the overflow, the attacker corrupts adjacent kernel structures to escalate from a normal user to SYSTEM. No public exploit code was identified at time of analysis, and user interaction is not required.