Windows NTFS EUVD-2026-99606

Exploitation requires the attacker to already possess authenticated low-privileged local code execution on the target Windows host (CVSS PR:L, AV:L) - there is no remote or network vector and no victim interaction is needed (UI:N). The trigger is an attacker-controlled process that reaches the vulnerable NTFS pointer-dereference path; NTFS is the default Windows filesystem, so no non-default configuration is required and all listed Windows 10/11, Server 2012 through Server 2025 builds below the patched versions are affected. The primary limiting factor is the prerequisite local foothold: this flaw cannot be used for initial access and is realistically a second-stage escalation step, which is why CISA SSVC rates it Automatable=no.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation flaw: the attacker must already have a foothold with low privileges (PR:L) and local access (AV:L), but once there, exploitation is low-complexity and yields total confidentiality, integrity and availability impact - consistent with a kernel-level NTFS untrusted-pointer-dereference (CWE-822) granting SYSTEM. Mitigating signals dominate the real-world picture: CISA's SSVC decision shows Exploitation=none and Automatable=no, meaning no observed exploitation and no reliable mass/automated weaponization path, even though Technical Impact=total agrees with the high CVSS impact metrics. There is no CISA KEV listing, no EPSS score provided, and no public POC identified, so no evidence of active or imminent widespread exploitation exists in the supplied data. The one data conflict worth flagging: the input Tags include 'Information Disclosure,' which contradicts both the description ('elevate privileges locally') and the C:H/I:H/A:H impact profile of an EoP - treat the tag as suspect, not the description. Net: patch on normal Patch-Tuesday cadence as a privilege-escalation chaining risk, prioritizing multi-user and RDP/terminal hosts, but this is not a drop-everything network-exploitable issue.

An attacker who has already gained a low-privileged local session (for example via phishing, a stolen standard-user credential, or a separate initial-access bug) runs a crafted process that triggers the untrusted pointer dereference in the Windows NTFS driver, corrupting kernel memory to escalate to SYSTEM. Because AC:L and no user interaction are required, exploitation is reliable once local access exists, but SSVC Exploitation=none and no public POC was identified, so this currently requires attacker-developed tooling.