Executive brief
A security vulnerability exists in the Windows NTFS file system, which is the primary system used by Windows to store and retrieve files on hard drives. An attacker could exploit this flaw to run unauthorized code on a target computer, potentially leading to a full system takeover or data theft. To carry out the attack, the intruder would typically need to trick a user into opening a specially crafted file or visiting a malicious site.
Technical details
An integer underflow vulnerability (CWE-191) exists in the Windows NTFS driver, which can lead to a heap-based buffer overflow (CWE-122). The vulnerability is triggered when the system processes malformed NTFS data, allowing for local code execution. While the attack vector is local, it requires user interaction, such as a user being enticed to interact with a malicious file or application. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user or potentially escalate privileges. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server 2012 versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 Standard and Server Core
Timeline
- 2026-07-14: disclosed: Initial publication of the CVE record by Microsoft.
- 2026-07-14: advisory: NVD and MSRC advisory published.