EUVD-2026-99598
GHSA-hwpq-4f9g-2w3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
DeliveryIssue crafted NTFS operation with overflowing size value
-
ExploitTrigger CWE-190 integer overflow in NTFS
-
ExecutionCorrupt kernel memory for arbitrary write
-
ImpactEscalate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have authenticated, low-privileged local code execution on the Windows host (PR:L, AV:L) - this is a privilege-escalation flaw, not a remote-entry one, and cannot be triggered over the network. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local access exists, escalation is straightforward against affected Windows versions running NTFS (the default filesystem). The key limiting factor is the local-access prerequisite: the attack surface is confined to scenarios where an untrusted or low-privileged principal can execute code, such as multi-user servers, shared workstations, terminal/RDS hosts, or a foothold gained via a separate initial-access vulnerability. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already be able to run code on the host with low privileges (PR:L), there is no user interaction, and attack complexity is low. This is a classic post-compromise escalation primitive rather than a remote entry point. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals cannot be weighed - absence of these is not evidence of low risk, but there is currently no positive signal of active exploitation or public exploit code. The signals are internally consistent (no CVSS-vs-description conflict: both indicate local, authenticated, low-complexity EoP). Real-world priority is driven primarily by the ubiquity of Windows NTFS and NTFS's history as a reliable local-EoP target, not by any confirmed exploitation. Treat as a standard-but-important Patch Tuesday EoP: patch in normal cycle, prioritize on multi-user or shared hosts where untrusted low-privileged code runs. |
| Exploit ScenarioDerived | A low-privileged user (or malware already running in a limited-user or sandboxed context) on a Windows host triggers an integer overflow in NTFS handling to corrupt kernel memory and escalate to SYSTEM. No user interaction is required and attack complexity is low, but the attacker must first have local code execution. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Windows NTFS file system driver allows an attacker who already holds low-privileged, authenticated code execution on a host to raise their privileges, ultimately reaching kernel-level (SYSTEM) context. The flaw is an integer overflow or wraparound (CWE-190) reachable with low attack complexity and no user interaction, so the only meaningful barrier is the local-access prerequisite (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) - this is not a remote-entry vulnerability and cannot be triggered over the network. There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); Microsoft has published an update guide for the CVE.
RemediationAI
Apply the Microsoft security update listed for this CVE in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69916; the input data does not include an exact knowledge-base or build number, so the specific patched build must be read from that advisory, and administrators should treat the associated monthly cumulative update as the primary fix (expect the usual servicing requirement of a reboot or restart of the affected host). Because the remaining attack surface is local code execution by a low-privileged user, compensating controls can reduce exposure but carry trade-offs: enforce least-privilege and remove unnecessary interactive logon rights on multi-user and RDS hosts (can break legitimate multi-session workflows), restrict which users and applications may write to untrusted or externally sourced NTFS volumes (reduces the attack surface but complicates interchange of disks and images), enable application control or WDAC-style allow-listing to block unvetted executables (high administrative overhead and can break line-of-business software), and tightly manage local administrator assignment so a successful escalation yields less value (does not fix the underlying memory-corruption defect). These measures are interim only - they do not eliminate the integer-overflow condition and should be replaced by the vendor patch as soon as it can be deployed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NTFS is the default and most widely deployed file system on Windows, and its implementation lives in kernel-mode driver code (notably ntfs.sys), which runs with the highest privilege level on the system. CWE-190 (Integer Overflow or Wraparound) is the root-cause class here: arithmetic on sizes, offsets, or counts derived from NTFS on-disk metadata can wrap around, producing a value that no longer matches the real data size. In kernel parsing code this typically leads to an undersized allocation, a mismatched bounds check, or an out-of-bounds write/read, which in turn corrupts kernel memory and gives the attacker a path from low-privileged user mode to code execution in kernel mode. Because the vulnerable component is the file-system driver rather than a remotely reachable service, exploitation is bound to local execution on the host; the Microsoft Security Response Center is credited as the reporting source and the CPE/product identifiers were not supplied in the input data, so affected builds should be enumerated directly from the MSRC update guide.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requires existing low-privileged code execution (AV:L, PR:L), triggers reliably without user interaction (AC:L, UI:N), and yields full SYSTEM compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity privilege-escalation flaw in the Windows NTFS file system driver allows an attacker who already holds a low-privileged authenticated foothold on a Windows host to escalate to full SYSTEM-level control, effectively converting a limited compromise into complete ownership of the machine. Because no vendor patch is yet available, every Windows endpoint and server in the estate remains exposed, and the practical risk is highest wherever attackers can readily obtain that initial foothold - phishing, malicious documents, or an unpatched remote-access path. Leadership should treat this as a patch-readiness and endpoint-hardening priority rather than a network-perimeter emergency, since the flaw cannot be triggered remotely on its own.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege by removing unnecessary local administrator rights and restricting interactive logon; apply application allowlisting or Windows Defender Application Control to block execution of untrusted binaries; enable and tune EDR and attack surface reduction rules to detect NTFS driver abuse, token theft, and SYSTEM-level process creation; monitor for local privilege-escalation indicators; and deploy the Microsoft update for CVE-2026-69916 immediately once it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB