Windows NTFS EUVD-2026-99338

Requires authenticated local access to the Windows host and the ability to run code that drives NTFS filesystem operations to trigger the use-after-free in the NTFS driver (AV:L, UI:N). Per Microsoft's vector the attacker must already hold high privileges (PR:H), though this is atypically high for an NTFS EoP and should be confirmed. Exploitation is limited to the specific patched Windows 11 (24H2/25H2/26H1) and Windows Server 2025 build ranges listed in the EUVD data; there is no remote or network-based path, and no default-configuration remote exposure. The practical limiting factors are the need for a valid local account/foothold and the local-only vector, which prevent remote or automatable mass exploitation (SSVC Automatable=no).

Signals are largely consistent and point to a moderate, not top-tier, priority. The CVSS 3.1 base score of 6.7 reflects a local attack vector (AV:L), low complexity (AC:L), and - per Microsoft - high privileges required (PR:H) with no user interaction, yielding full confidentiality/integrity/availability impact (C:H/I:H/A:H) on an unchanged scope. CISA's SSVC framework reinforces this: Exploitation=none (no known in-the-wild activity), Automatable=no (local-only, cannot be mass-scanned/wormed), but Technical Impact=total (consistent with a kernel use-after-free granting SYSTEM). There is no CISA KEV listing and no public POC referenced, so this is not confirmed as actively exploited. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. One notable tension: Microsoft sets PR:H, which is unusually high for an NTFS local privilege-escalation UAF (such flaws are frequently exploitable by any low-privileged authenticated user, i.e. PR:L); if PR is in fact lower, real-world risk would be higher than the 6.7 suggests - verify the exact privilege prerequisite with Microsoft. Also note the 'Denial Of Service' tag conflicts with the description, which states privilege elevation, not availability loss - treat the DoS characterization with caution.

An attacker who already has a valid local account on a Windows host runs a crafted program that manipulates NTFS operations to trigger the use-after-free in the filesystem driver, corrupting kernel memory to execute code at SYSTEM level. No user interaction is required and the attack is entirely local. No public exploit identified at time of analysis, so a working exploit would need to be developed.