CVE-2026-49184

What it actually does

This is a heap-based buffer overflow in the Windows NTFS filesystem driver. A local, unauthenticated attacker who can cause Windows to parse malicious NTFS filesystem data may corrupt kernel memory and potentially execute arbitrary code in the Windows kernel context. Successful exploitation can lead to full system compromise, including privilege escalation to SYSTEM-level control, disabling security tooling, tampering with data, or crashing the host. The CVSS vector indicates local attack requirements, low complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Affected Windows workstations and servers are exposed to local code execution risk if an attacker can interact with the system or cause it to process crafted NTFS content. While there is no current KEV listing, no known ransomware association, low EPSS, and no public exploit maturity reported, the high severity means successful exploitation could result in endpoint takeover, lateral movement enablement, service interruption, or loss of sensitive data. Organizations with broad Windows 10, Windows 11, and Windows Server fleets should prioritize normal-to-expedited patching, especially for shared systems, kiosks, VDI, jump hosts, build systems, file-processing systems, and servers that accept removable or mounted storage media.

How an attack unfolds

An attacker first obtains local access to an affected Windows system or otherwise gains the ability to make the system parse attacker-controlled NTFS filesystem structures, such as through a crafted local volume, virtual disk, disk image, or storage device. The attacker supplies malformed NTFS metadata that triggers a heap buffer overflow in the NTFS driver during filesystem handling. If exploitation is successful, memory corruption is shaped to redirect execution flow in kernel mode. The attacker can then run code with elevated privileges, potentially installing persistence, dumping credentials, disabling endpoint defenses, modifying files, or pivoting to other systems. Failed exploitation attempts may cause filesystem errors, application failures, or a system crash involving ntfs.sys.

How to fix it

Apply the Microsoft security update that addresses this NTFS vulnerability for all affected Windows versions: Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. No product-specific fixed build numbers were provided in the input, so use the latest applicable cumulative update or security-only update from Microsoft for the affected operating system version. Prioritize systems that process removable media, virtual disks, disk images, backup media, user-supplied files, or untrusted storage. Where immediate patching is not possible, reduce exposure by restricting use of removable storage, blocking untrusted VHD/VHDX/ISO mounting where feasible, enforcing least privilege, limiting interactive logon rights, and ensuring endpoint protection and attack surface reduction controls are active.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft update that remediates this NTFS vulnerability, using Windows Update, WSUS, Microsoft Configuration Manager, Intune, vulnerability management tools, or PowerShell inventory of installed hotfixes and OS build levels. Validate that unsupported or out-of-servicing Windows versions are upgraded or isolated. For mitigation validation, confirm removable media policies, device control, and disk-image mounting restrictions are enforced where used. Conduct authenticated vulnerability scans after patch deployment and verify that scanners no longer report the host as affected. Review a representative sample of workstations and servers, including offline, remote, and intermittently connected devices.

Typical attack path

1. Identify an unpatched Windows 10, Windows 11, or Windows Server system affected by the NTFS vulnerability.
2. Gain local access or a pathway for the system to process attacker-controlled NTFS content, such as a mounted disk image, virtual disk, or removable storage device.
3. Trigger parsing of malformed NTFS filesystem structures by the Windows NTFS driver.
4. Exploit heap memory corruption to achieve code execution in kernel context.
5. Use elevated execution to obtain SYSTEM-level control, disable defenses, dump credentials, modify files, or establish persistence.
6. Cover tracks by removing the crafted NTFS artifact, clearing temporary files, or attempting to delete relevant logs.

How to detect it

To determine whether exploitation may have already occurred, review Windows system and security telemetry for signs of malicious local storage parsing followed by privilege escalation or system instability. Focus on Windows Event Logs, crash dumps, endpoint detection telemetry, removable media/device-control logs, PowerShell logs, process creation telemetry, and file integrity events. Look for unexpected bugchecks, crashes, or filesystem errors involving ntfs.sys; unusual mounting of VHD, VHDX, ISO, or removable NTFS media; sudden SYSTEM-level process creation from unusual parent processes; disabling of security tools; credential dumping behavior; and cleanup activity after a filesystem crash. Correlate timestamps for storage-device insertion or disk-image mounting with ntfs.sys crashes, privilege escalation artifacts, new services, scheduled tasks, suspicious driver loads, or endpoint protection tampering. Because no public exploit maturity or named threat actor activity is reported, detection should be behavior-based rather than relying on a known exploit filename or hash.

• ntfs.sys
• \SystemRoot\System32\drivers\ntfs.sys
• NTFS_FILE_SYSTEM
• BugCheck 0x24
• Event ID 1001
• Event ID 55
• Event ID 98
• The file system structure on the disk is corrupt and unusable
• A corruption was discovered in the file system structure
• vhdmount
• Mount-DiskImage
• New-VHD
• AttachVirtualDisk
• \.\PhysicalDrive
• \.\Volume
• SYSTEM_SERVICE_EXCEPTION
• KERNEL_SECURITY_CHECK_FAILURE
• PAGE_FAULT_IN_NONPAGED_AREA

What your security team should do

• Patch affected Windows endpoints and servers with the latest Microsoft cumulative or security update, prioritizing high-value servers, shared workstations, administrative workstations, VDI images, kiosks, and systems that process removable or mounted storage.
• Inventory all affected Windows 10, Windows 11, and Windows Server versions and track remediation coverage, including dormant systems and golden images.
• Temporarily restrict untrusted removable media and untrusted VHD/VHDX/ISO mounting until patch coverage is complete.
• Hunt for recent crashes, bugchecks, or filesystem errors involving ntfs.sys, especially on systems where removable storage or mounted disk images were used.
• Ensure endpoint detection and response tooling is active and tamper protection is enabled, because successful exploitation may lead to kernel-level or SYSTEM-level attacker activity.
• Monitor Microsoft advisories for updated fixed build information, exploitation reports, or changes in KEV status.
• Use least-privilege controls and limit interactive logon rights on servers to reduce opportunities for local exploitation.