Windows NTFS EUVD-2026-99998

Requires an attacker to already possess local, authenticated low-privilege access to the Windows host (AV:L, PR:L) - this is not remotely reachable and not exploitable by anonymous users. The flaw is in NTFS error handling (CWE-209): the attacker must drive the filesystem into a specific error condition that emits sensitive information, and the high attack complexity (AC:H) indicates success depends on a race condition or a precise system state the attacker cannot fully control, limiting reliability. No user interaction is required (UI:N). Impact is confined to information disclosure (C:H, I:N, A:N); the attacker cannot modify data or cause denial of service through this issue. Realistic exposure is highest on multi-user or shared Windows systems where untrusted low-privilege principals run alongside sensitive data.

This is a genuinely low-priority issue despite its HIGH confidentiality sub-metric. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, base 4.7, Medium) tells a consistent story: exploitation requires local access (AV:L), already-granted low privileges (PR:L), and high attack complexity (AC:H) - meaning the attacker must win a race, hit a specific state, or satisfy conditions outside their control to make NTFS emit an error message that leaks sensitive memory/filesystem data (CWE-209). All signals agree it is not a widespread-exploitation threat: SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial, which maps to a low-urgency 'Track' decision. There is no CISA KEV listing and no public POC, so per the data this is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one notable tension is C:H (high confidentiality impact) against the otherwise low enabling conditions - the HIGH rating reflects the potential value of leaked data, not ease of attack; the AC:H and PR:L gating is what keeps real-world risk modest. Bottom line: a legitimate but non-urgent patch-cycle item, not an emergency.

A low-privileged local user (e.g., a standard account or a process in a shared/multi-tenant Windows host) performs crafted NTFS operations designed to force the filesystem into an error path, then reads the resulting error output to recover sensitive information such as memory contents or restricted filesystem metadata. Because attack complexity is high, the attacker likely must repeatedly trigger a specific race or state to succeed. No public exploit code is identified at time of analysis.