CVE-2026-50386

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows NTFS file system driver. A local, unauthenticated attacker can trigger memory corruption through specially crafted NTFS-related input, likely involving a malformed file system structure, file, disk image, or removable/storage media interaction that causes Windows to parse attacker-controlled NTFS metadata. Successful exploitation can allow arbitrary code execution in the local system context or another highly privileged kernel-adjacent execution context, resulting in full confidentiality, integrity, and availability impact. The CVSS vector indicates local attack access, low attack complexity, no privileges required, and required user interaction.

Why it matters to the business

Successful exploitation could let an attacker take full control of an affected Windows workstation or server after a user interacts with malicious storage content, enabling data theft, tampering, malware installation, lateral movement, or disruption of endpoint and server operations. The issue affects a broad range of supported Windows client and server versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025, so exposure may be widespread in mixed Windows estates. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported exploit maturity, but the potential impact is high because successful exploitation can result in complete host compromise.

How an attack unfolds

An attacker prepares malicious NTFS content designed to trigger a heap overflow when parsed by the Windows NTFS driver. The attacker then delivers that content in a form that causes local interaction, such as a removable drive, mounted virtual disk, disk image, archive containing crafted file system content, or other workflow that leads a user or system process to access the malformed NTFS structure. When the affected Windows system processes the crafted NTFS metadata, memory corruption occurs in the file system driver. If the attacker can shape the overflow reliably, they may redirect execution flow and run code with elevated local privileges. After execution, the attacker can install persistence, disable security tools, collect credentials or sensitive files, and use the compromised host as a foothold for further activity.

How to fix it

Apply the vendor security update for all affected Windows versions as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or the organization’s standard patch management platform. Because no exact fixed build or KB is provided in the input, remediation should be verified against Microsoft’s official advisory and monthly cumulative update guidance for the affected Windows releases. Prioritize internet-facing servers, shared workstations, administrator workstations, jump hosts, file servers, systems that regularly handle removable media, and systems that mount user-supplied disk images. If immediate patching is not possible, reduce exposure by blocking or tightly controlling removable media, restricting the mounting of disk images and virtual disks from untrusted sources, disabling AutoPlay/AutoRun, limiting local interactive access, enforcing least privilege, and ensuring endpoint protection can scan removable and mounted media before use.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative update or security update that supersedes the vulnerable NTFS driver version for its operating system release. Validate using centralized patch compliance tooling, Windows Update history, installed hotfix inventory, and file version checks for the NTFS driver where vendor guidance provides the fixed version. Test mitigations by confirming AutoPlay/AutoRun restrictions, removable media controls, and disk image mounting policies are enforced. Exposure remains if affected Windows versions are unpatched, allow users to mount or access untrusted NTFS-formatted media or images, or lack controls over removable storage and local interactive workflows.

Typical attack path

1. Identify a target using an affected Windows client or server version.
2. Create malicious NTFS content that triggers the heap-based overflow during file system parsing.
3. Deliver the content through a local-interaction vector, such as removable media, mounted disk image, virtual disk, or other user-accessed storage content.
4. Convince a user or process to open, mount, browse, scan, or otherwise interact with the crafted content.
5. Trigger memory corruption in the NTFS driver.
6. Execute attacker-controlled code locally, potentially with high privileges.
7. Establish persistence, collect credentials or sensitive data, disable defenses, or move laterally.

How to detect it

To determine whether exploitation may already have occurred, review endpoint telemetry, Windows Event Logs, crash dumps, Windows Error Reporting records, EDR process lineage, and removable media or disk image activity. Focus on sequences where a removable drive, mounted virtual disk, ISO/VHD/VHDX, or unusual storage device was accessed shortly before an NTFS driver crash, system bugcheck, abnormal process launch, privilege escalation alert, or security-tool tampering. Useful sources include System logs for disk, NTFS, mount, and bugcheck events; Application logs for Windows Error Reporting; Security logs for logon and privilege-use events; Sysmon or EDR telemetry for process creation, driver load, image load, removable media insertion, file creation on mounted volumes, and suspicious post-exploitation behavior. Look for crashes or dumps referencing ntfs.sys, bugchecks involving NTFS_FILE_SYSTEM, and subsequent execution of command shells, scripting engines, credential tools, persistence mechanisms, or unsigned binaries. Because no public exploit or malware signature is provided, detection should rely on behavioral correlation rather than a single definitive IOC.

• ntfs.sys
• NTFS_FILE_SYSTEM
• %SystemRoot%\System32\drivers\ntfs.sys
• Microsoft-Windows-WER-SystemErrorReporting
• Windows Error Reporting
• BugCheck
• The computer has rebooted from a bugcheck
• .vhd
• .vhdx
• .iso
• powershell.exe
• cmd.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• schtasks.exe

What your security team should do

• Track the official Microsoft advisory and map the applicable cumulative update or fixed build for each affected Windows version.
• Patch affected Windows clients and servers through normal emergency or high-priority endpoint patching workflows, prioritizing systems with local user interaction, removable media use, or administrative access.
• Temporarily restrict untrusted removable media, mounted disk images, and virtual disk files until patch coverage is confirmed.
• Disable AutoPlay and AutoRun across Windows endpoints if not already enforced.
• Harden endpoint controls to scan removable media and mounted disk images before user access.
• Monitor for NTFS driver crashes, unexpected bugchecks, or Windows Error Reporting events referencing NTFS immediately before suspicious process execution.
• Review endpoint detections for privilege escalation, abnormal child process creation, credential access, defense evasion, and persistence following storage-media interaction.
• Maintain heightened monitoring even though the vulnerability is not currently in KEV, is not known to be used in ransomware, and has low EPSS, because successful exploitation has full host compromise potential.