Executive brief
A security vulnerability has been identified in the Windows NTFS file system, which is responsible for how the computer stores and retrieves files on the hard drive. An attacker who already has limited access to a system could exploit this flaw to run malicious code with elevated privileges. This could lead to a full system takeover, unauthorized data access, or disruption of business operations.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists within the Windows NTFS driver. The flaw is triggered when the system processes specially crafted file system structures. While the attack vector is local, it requires user interaction, such as a user opening a malicious file or mounting a compromised drive. Successful exploitation allows an attacker to execute arbitrary code in the context of the kernel or a highly privileged service, leading to full system compromise. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory