Executive brief
A security vulnerability exists in the Windows NTFS file system, which is responsible for how the operating system stores and retrieves files on hard drives. An attacker who successfully exploits this could gain the ability to run malicious code on a target computer. While the attack requires a user to perform an action, such as opening a malicious file, it could lead to a full system compromise or data theft.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in the Windows New Technology File System (NTFS) driver. The flaw is triggered when the system processes specially crafted file system metadata, leading to memory corruption. An attacker can exploit this locally by convincing a user to interact with a malicious file or partition (User Interaction required). Successful exploitation allows for arbitrary code execution with the privileges of the current user or potentially elevated system privileges. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server 2012 versions.
Affected products
- Microsoft Windows 10 Version 1607 10.0.14393.0 to 10.0.14393.9339
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2012 6.2.9200.0 to 6.2.9200.26226
Timeline
- 2026-07-14: disclosed: Initial publication by Microsoft and NVD
- 2026-07-14: advisory