Windows NTFS EUVD-2026-99924

Exploitation requires the attacker to already possess local access with at least low-level privileges (CVSS PR:L) on an affected Windows system - i.e., the ability to execute a crafted local process that passes attacker-controlled format-string input into the vulnerable Windows NTFS code path. No user interaction is required (UI:N) and no special or non-default configuration is indicated; the vulnerable NTFS driver is part of default Windows installations across the listed Windows 10/11, Server 2012 through Server 2025 builds. The principal limiting factor is the need for a pre-existing authenticated local foothold: the flaw is not remotely reachable (AV:L) and SSVC marks it non-automatable, so it serves as a privilege-escalation stage rather than an initial-access or self-spreading vector.

This is a local elevation-of-privilege flaw in Windows NTFS (CWE-134, externally-controlled format string). The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) indicates a local attack vector with low complexity requiring low privileges and no user interaction, yielding total confidentiality, integrity and availability impact - consistent with full SYSTEM compromise from a low-privileged foothold. The signals are internally consistent but point to a prioritize-but-not-emergency posture: CISA's SSVC decision shows Exploitation=none, Automatable=no, and Technical Impact=total, meaning high damage potential if exploited but no observed exploitation and no automatability (expected for a local EoP that cannot self-propagate). There is no KEV listing, no POC reference, and no EPSS score in the supplied data - so exploitation probability cannot be quantified and absence of EPSS/KEV/POC should not be read as proof of safety. Because PR:L requires an attacker to already hold a valid low-privileged local account or code-execution foothold, real-world risk is gated on prior access; this is a classic second-stage privilege-escalation primitive rather than an initial-access or wormable threat. Net: a genuine patch-priority item given ubiquitous Windows footprint and total technical impact, but not an immediate drop-everything emergency absent evidence of active exploitation.

An attacker who has already gained a low-privileged foothold on a Windows host (e.g., via phishing, a standard user account, or a prior exploit) runs a crafted local process that supplies attacker-controlled format-string data to a vulnerable NTFS code path, corrupting memory or manipulating formatted output to escalate to SYSTEM. No user interaction is required and attack complexity is low once local access exists. No public exploit identified at time of analysis.