Windows NTFS EUVD-2026-99974

Requires local, authenticated access to an affected Windows system (PR:L, AV:L) - the attacker must already be able to run code or interact with the NTFS filesystem as a low-privileged user, so this is not remotely reachable. No user interaction by a victim is needed (UI:N). Exploitation targets the Windows NTFS driver's handling of on-disk/volume structures; the practical limiting factor is that an attacker must first gain a local foothold, and the bug yields only memory disclosure (C:H, I:N, A:N) with no direct code execution or system modification. Applies to unpatched builds listed in the EUVD ranges (e.g., Windows 11 24H2 below 10.0.26100.9711, Server 2025 below 10.0.26100.33650).

This is a genuine but low-urgency issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5 Medium) describes a locally-exploitable, low-privilege information disclosure with no integrity or availability impact. All exploitation signals point the same direction and reinforce the modest rating: CISA SSVC reports Exploitation=none, Automatable=no, and Technical Impact=partial, and there is no CISA KEV listing and no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be factored in. The signals are consistent rather than conflicting - a local, authenticated, non-automatable memory-disclosure bug with a patch already available. Priority should be routine patch-cycle remediation, not emergency response; the main practical value to an attacker is as a secondary primitive (e.g., leaking kernel/memory addresses to defeat ASLR) chained with a separate escalation bug rather than as a standalone threat.

An attacker who already has a low-privileged local account or code execution on a Windows host interacts with a specially crafted NTFS structure to trigger an out-of-bounds read, causing adjacent memory contents to be returned to the attacker. The leaked data (such as pointers or sensitive kernel/process memory) is then used to inform a follow-on exploit. No public exploit code was identified at time of analysis, and exploitation requires local access, limiting opportunistic use.