Executive brief
A security vulnerability has been identified in the Windows NTFS file system, which is responsible for how the operating system stores and retrieves files on hard drives. An attacker who successfully exploits this flaw could execute malicious code on a target computer. While the attack requires local access or user interaction, it could lead to a full system compromise, allowing unauthorized access to sensitive data or the disruption of business operations.
Technical details
A heap-based buffer overflow (CWE-122) exists within the Windows NTFS driver. The vulnerability is triggered when the system processes specially crafted file system structures. Although the attack vector is classified as local, it requires user interaction (UI:R), such as a user opening a malicious file or mounting a compromised drive. Successful exploitation allows an attacker to execute arbitrary code with elevated privileges, potentially leading to a complete takeover of the host. Microsoft has released security updates to address this issue across multiple versions of Windows 10, Windows 11, and Windows Server 2012.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory