Executive brief
Windows NTFS, the file system that stores and manages data on Windows computers, contains a vulnerability that allows an authorized local user to read memory regions they should not have access to. An attacker with local system access could exploit this flaw to view sensitive information stored in system memory, potentially including passwords, encryption keys, or other confidential data.
Technical details
The vulnerability is an out-of-bounds read flaw in the Windows NTFS file system driver. An authenticated local attacker can craft specific file system operations to trigger a read beyond allocated buffer boundaries, allowing disclosure of adjacent kernel memory. The attack requires local access to the system and does not grant remote code execution, but can leak sensitive data from kernel memory regions. A patch addressing this issue is expected to be available from Microsoft.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed