Windows NTFS EUVD-2026-99932

Exploitation requires the attacker to already have local access to the host and to hold at least low-level privileges (PR:L) - i.e. an existing standard-user or equivalent account or code-execution foothold; this is a local privilege-escalation vector, not remotely reachable (AV:L). No user interaction is needed (UI:N), and attack complexity is low (AC:L), but the need for prior local authenticated access is the primary limiting factor and sharply narrows realistic exposure to multi-user, shared, or already-compromised systems. The flaw resides in the NTFS filesystem handling present by default in every affected Windows build, so no special non-default feature or configuration is required once local access is obtained.

This is a genuinely moderate-priority local privilege-escalation/code-execution flaw rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) signals that an attacker must already have local access and low-level privileges (PR:L) on the host; it is not remotely exploitable. The signals are consistent and point toward lower real-world urgency: CISA's SSVC decision framework rates Exploitation as 'none' (no observed or public exploitation) and Automatable as 'no' (the attacker cannot reliably reproduce it at scale), even though Technical Impact is 'total' (full compromise of the NTFS-handling component). There is no CISA KEV listing and no public exploit identified, so active exploitation is not indicated. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a data gap. The 'total' technical impact and C:H/I:H/A:H do warrant patching on multi-user or shared Windows hosts where untrusted users have local access, but the local-only vector plus required privileges and non-automatable nature place this below internet-facing or wormable issues in prioritization.

A low-privileged attacker who already has a foothold on a Windows system (for example a standard user account, or via an initial-access payload) crafts a malicious NTFS structure or triggers a flawed NTFS operation that overflows a heap buffer in the filesystem driver. Successful exploitation corrupts kernel/driver heap memory to execute arbitrary code at elevated privilege, completing a local privilege escalation. No public exploit code was identified at time of analysis.