Executive brief
A security vulnerability has been identified in the Windows NTFS file system, which is responsible for how the computer stores and retrieves files on the hard drive. An attacker who successfully exploits this flaw could run malicious code on the affected system. While the attack must be launched locally, it could lead to a full system compromise, potentially allowing unauthorized access to sensitive data or disrupting business operations.
Technical details
A heap-based buffer overflow (CWE-122) exists within the Windows NTFS driver. The vulnerability is triggered locally, though it requires some form of user interaction as indicated by the CVSS UI:R vector (e.g., a user opening a specially crafted file or mounting a malicious filesystem). Successful exploitation allows an attacker to execute arbitrary code with elevated privileges on the local system. Microsoft has released security updates to address this issue across multiple versions of Windows 10, Windows 11, and Windows Server 2012.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All editions including Server Core
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory