Executive brief
Windows NTFS is a core component of Microsoft Windows that manages file storage and access on hard drives. A heap buffer overflow vulnerability in NTFS allows an attacker with local access to overwrite memory and escalate their privileges to system administrator level, potentially gaining complete control of an affected computer.
Technical details
The vulnerability is a heap-based buffer overflow in the Windows NTFS file system driver. An authenticated local attacker can trigger the overflow through a specially crafted file system operation, corrupting heap memory and achieving arbitrary code execution with elevated privileges. The attack requires local access and valid credentials, but does not require user interaction beyond initiating the malicious operation. The attacker can leverage this to execute code with SYSTEM-level privileges, effectively compromising the entire machine. A patch is expected to be available through Microsoft's regular security update process.
Affected products
- Microsoft Windows NTFS
Timeline
- 2026-09-08: disclosed