Windows NTFS EUVD-2026-99904

Requires authenticated local access to the Windows host with at least low-level privileges (CVSS PR:L) and local code execution to invoke the vulnerable NTFS code path; no user interaction is needed (UI:N) and no non-default feature must be enabled, since NTFS is the default Windows filesystem. The decisive limiting factor is that exploitation is not remote - the attacker must already have a valid local foothold or account on the target - which bounds this to post-compromise privilege escalation rather than initial access. Affected builds span Windows 10/11 (1607 through 26H1), Windows Server 2012 through 2025, and their Server Core installations below the fixed build numbers listed in the EUVD data.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw in a core OS component with full confidentiality/integrity/availability impact once triggered, but critically it requires local access and existing low-level privileges (PR:L) - it is not remotely reachable. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence set, so there is no positive signal of mass or active exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent (a CWE-125 out-of-bounds read used for EoP matches the local, authenticated, no-UI vector), so there is no contradiction to flag. The practical risk is that this is strong post-compromise/chaining material - an attacker who already has a foothold can escalate to SYSTEM - rather than an initial-access threat. Given it was reported by Microsoft itself and a patch already exists, it most resembles a routine Patch-Tuesday-class EoP: patch on normal cadence, prioritized on multi-user/shared Windows hosts, but not an emergency absent emerging exploitation data (EPSS/KEV were not provided and cannot be inferred).

An attacker who already holds a low-privileged account on a Windows host (e.g., after phishing, a web-shell, or a standard-user login) runs a crafted program that forces the NTFS driver to read past an allocated buffer, leaking kernel memory contents that are then leveraged to elevate to SYSTEM. No user interaction is required and the attack runs locally. No public exploit code was identified in the provided intelligence.