Executive brief
A security vulnerability has been identified in the Windows NTFS file system, which is responsible for managing how data is stored and retrieved on hard drives. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to view sensitive files, install malicious software, or disrupt business operations.
Technical details
This vulnerability (CVE-2026-50672) is a use-after-free (UAF) flaw within the Windows NTFS driver, often triggered by a race condition (CWE-362) during concurrent execution using shared resources. An attacker must have local access and valid login credentials (low privilege) to exploit the flaw. Successful exploitation allows the attacker to execute code with elevated privileges, potentially gaining full SYSTEM access. The attack complexity is rated as high, likely due to the precise timing required to trigger the race condition and subsequent memory corruption. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory