CVE-2026-45636

What it actually does

CVE-2026-45636 is a heap-based buffer overflow in the Windows NTFS file system driver. A local, unauthenticated attacker can cause NTFS to parse specially crafted file system data and corrupt kernel heap memory. Successful exploitation can result in arbitrary code execution in kernel context, giving the attacker full control over the affected Windows system. The CVSS vector indicates local access, low attack complexity, no prior privileges required, and required user interaction, meaning exploitation likely depends on a user or system action that causes Windows to mount, open, scan, or otherwise process attacker-controlled NTFS content.

Why it matters to the business

Successful exploitation could allow an attacker who can persuade a user to interact with malicious storage media or crafted NTFS content to fully compromise a Windows workstation or server. This can lead to data theft, malware installation, credential harvesting, lateral movement, and disruption of business services. The issue affects many supported Windows desktop and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so exposure may be broad in mixed enterprise environments. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at this time, but kernel-level code execution flaws should still be prioritized because successful exploitation gives the attacker complete host control.

How an attack unfolds

An attacker prepares NTFS file system content designed to trigger incorrect heap memory handling in the Windows NTFS driver. The content may be delivered through a removable drive, mounted disk image, virtual disk, archive workflow, forensic image, or another local mechanism that causes Windows to parse attacker-controlled NTFS structures. The attacker then convinces a user or automated process to mount, open, scan, or otherwise interact with that content. When the vulnerable NTFS code processes the malformed data, a heap-based buffer overflow occurs in kernel space. If the attacker can control the memory corruption reliably, they can redirect execution and run code with kernel privileges. From there, they can disable security controls, install persistence, extract credentials, tamper with files, and move laterally. Failed exploitation attempts may produce NTFS-related system crashes or bugchecks rather than reliable code execution.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-45636 for all affected Windows versions. Because fixed version numbers were not provided, use the latest cumulative security updates for the applicable Windows 10, Windows 11, and Windows Server releases, including Windows Server 2012, 2016, 2019, 2022, and 2025 where still supported. Prioritize endpoints and servers that commonly process removable media, disk images, virtual disks, backups, forensic images, file shares, or untrusted storage content. If immediate patching is not possible, reduce exposure by restricting removable media use, limiting the mounting of untrusted disk images or virtual disks, enforcing least privilege for local logon, disabling AutoPlay/AutoRun behavior, scanning removable media on isolated systems, and ensuring endpoint protection can block suspicious kernel tampering and post-exploitation behavior.

How to confirm the fix worked

Confirm that affected Windows systems have installed the relevant cumulative security update released by Microsoft for this vulnerability or a later superseding update. Validate patch deployment through centralized patch management, Windows Update history, vulnerability scanning, or authenticated inventory checks. Confirm the version and patch level of supported Windows 10, Windows 11, and Windows Server systems against Microsoft’s security update guidance. For mitigation validation, test that removable media policies, AutoPlay/AutoRun restrictions, and controls for mounting untrusted disk images or virtual disks are enforced. Where practical, review recent system stability telemetry for NTFS-related bugchecks before and after patching to identify possible attempted exploitation or malformed-media handling.

Typical attack path

1. Attacker creates malicious NTFS-formatted content that triggers the heap overflow condition.
2. Attacker delivers the content locally, such as through removable media, a mounted image, a virtual disk, or another workflow that causes Windows to parse NTFS metadata.
3. A user or automated process interacts with the content, satisfying the user-interaction requirement.
4. Windows loads or parses the crafted NTFS structures through the vulnerable NTFS driver path.
5. The malformed data causes heap memory corruption in kernel space.
6. Attacker-controlled execution is achieved in kernel context if exploitation is successful.
7. Attacker uses kernel-level access to disable defenses, install malware or persistence, access sensitive data, or pivot to other systems.

How to detect it

There are no publicly reliable exploit-specific indicators in the provided data, and exploit maturity is listed as none. To assess whether exploitation may already have occurred, review Windows System event logs, crash dumps, EDR telemetry, and removable media activity around times when unknown USB devices, mounted disk images, virtual disks, or NTFS volumes were accessed. Look for NTFS-related kernel crashes, repeated bugchecks after media insertion or image mounting, suspicious processes interacting with newly mounted volumes, and immediate follow-on behaviors such as disabling security tools, loading unusual drivers, dumping credentials, creating persistence, or making outbound connections. Useful log sources include Windows System logs, Microsoft-Windows-Kernel-PnP device events, Microsoft-Windows-Partition/Diagnostic events where available, Windows Error Reporting, memory dump metadata, EDR device-control telemetry, removable-storage audit logs, PowerShell logs, Sysmon logs, and security product tamper-protection events. Treat NTFS crashes alone as suspicious but not conclusive; correlate with user interaction, new device or volume mount activity, and post-exploitation behaviors.

• ntfs.sys
• NTFS_FILE_SYSTEM
• KERNEL_MODE_HEAP_CORRUPTION
• PAGE_FAULT_IN_NONPAGED_AREA
• SYSTEM_SERVICE_EXCEPTION
• BugCheck 0x13A
• BugCheck 0x24
• \SystemRoot\System32\drivers\ntfs.sys
• Microsoft-Windows-Kernel-PnP
• Microsoft-Windows-Partition
• Windows Error Reporting

What your security team should do

• Inventory all affected Windows desktop and server versions and prioritize patching broadly because exploitation would provide kernel-level code execution.
• Apply the latest Microsoft cumulative security updates to all affected systems, prioritizing endpoints exposed to removable media, disk images, backups, forensic workflows, developer environments, and file-processing operations.
• Restrict or monitor the use of removable storage, mounted disk images, and virtual disk files from untrusted sources until patching is complete.
• Disable AutoPlay/AutoRun and enforce device control policies for USB and other removable media.
• Increase monitoring for NTFS driver crashes, unexpected bugchecks, suspicious removable media activity, and post-exploitation behavior such as security tool tampering or credential dumping.
• Educate help desk, IT operations, and users not to mount or inspect unknown disk images or removable drives on production systems.
• Use EDR controls to detect suspicious kernel-level tampering, unsigned driver activity, privilege escalation behavior, and unusual child processes spawned after removable media interaction.
• Because the vulnerability is not currently in CISA KEV and has low EPSS, schedule remediation according to normal high-severity kernel vulnerability timelines, but accelerate for high-risk systems that process untrusted storage content.