Windows NTFS EUVD-2026-99792

Exploitation requires the attacker to already possess local, authenticated access to the target Windows system (PR:L) - e.g., an interactive low-privileged user session or control of a low-privilege process capable of executing code that interacts with the NTFS driver. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the vector is strictly local (AV:L): there is no network-reachable path, which materially limits exposure to insiders, post-compromise lateral movement, or malware that has already gained a foothold. The flaw affects default configurations of the NTFS filesystem driver across the listed Windows 10/11 and Windows Server 2012-2025 builds, so no special non-default feature needs to be enabled; the primary limiting factor is the prerequisite of existing local code execution.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already have local, authenticated access (PR:L) before exploiting it, which caps real-world urgency compared to a remote unauthenticated bug. CISA's SSVC framework reinforces a measured posture - Exploitation: none, Automatable: no, Technical Impact: total - meaning there is no observed exploitation and the flaw cannot be mass-automated, even though successful exploitation yields total impact (full system compromise, consistent with C:H/I:H/A:H). There is no CISA KEV listing and no public exploit identified, so this is not currently weaponized. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. Note a classification tension: the Description and CWE-125 (out-of-bounds read) frame this as an elevation-of-privilege/memory-read issue, yet the input Tags include 'Information Disclosure', and an OOB read primarily threatens confidentiality - the C:H/I:H/A:H vector reflects Microsoft's standard treatment of a local EoP to SYSTEM rather than a pure read primitive. Overall: a real patch-worthy issue, especially on multi-user or shared hosts, but a high-CVSS-but-low-immediate-real-risk profile given local-only access and no exploitation signal.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or a compromised low-privilege service) runs a crafted program that triggers an out-of-bounds read in the NTFS driver to leak kernel memory and escalate to SYSTEM. Because AC:L and UI:N, no user interaction or special timing is needed once local code execution is available. No public proof-of-concept has been identified at the time of analysis.