Windows NTFS EUVD-2026-99917

Exploitation requires the attacker to already hold a valid, authenticated low-privileged local account and the ability to execute code on the target Windows host (PR:L, AV:L); it cannot be triggered remotely or over the network. The flaw is in the NTFS file-system driver, so the attacker must be able to invoke NTFS operations locally - which is the default for any interactive or service user on Windows. No user interaction is required (UI:N). Limiting factors: the need for pre-existing local authenticated access, no remote vector, and SSVC rating Automatable 'no' (not suitable for scaled/automated exploitation) meaningfully constrain real-world risk despite the high technical impact. All supported and currently patched Windows client and server builds listed in the EUVD ranges are affected in default configuration.

This is a genuine but not emergency-priority vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U) describes a local, low-complexity attack requiring an already-authenticated low-privileged user - not a remotely reachable flaw - which caps real-world risk to post-access scenarios. CISA's SSVC framework reinforces this: Exploitation is rated 'none' (no observed or public exploitation) and Automatable is 'no', meaning it cannot be mass-exploited at scale, even though Technical Impact is 'total' (consistent with the C:H/I:H/A:H full-impact rating and the 7.8 base score). The vulnerability is not in CISA KEV, has no EPSS score provided, and no public proof-of-concept is indicated, so exploitation status is 'no public exploit identified at time of analysis'. The signals are internally consistent - high technical impact but constrained exploitability - so this is a real patch-worthy issue best handled on a standard elevation-of-privilege cadence rather than an out-of-band emergency. Note one metadata tension: the input Tags include 'Information Disclosure', yet both the description and MSRC frame this as an elevation-of-privilege (EoP); verify the exact impact classification with Microsoft's advisory. EPSS data is absent, so probabilistic exploitation likelihood could not be weighed.

An attacker who already has low-privileged code execution on a Windows host (via phishing, a prior foothold, or a standard user account) runs a crafted program that triggers an out-of-bounds read in the NTFS driver to leak kernel memory or corrupt privileged state, escalating to SYSTEM. No user interaction and no special network position is needed, but the attacker must first be authenticated and local on the machine. No public exploit code is identified at time of analysis.