CVE-2026-50494

What it actually does

This is a local privilege-escalation vulnerability in the Windows NTFS file-system driver caused by a heap-based buffer overflow. An attacker who already has valid local code execution with low privileges can trigger malformed NTFS-related input or file-system activity that corrupts kernel memory. Successful exploitation can allow execution of attacker-controlled code in the Windows kernel context, commonly resulting in SYSTEM-level privileges and full compromise of confidentiality, integrity, and availability on the affected host.

Why it matters to the business

A compromised low-privilege account or malware already running on an affected Windows workstation or server could use this flaw to gain complete control of the machine. This can enable credential theft, disabling of security tools, lateral movement, ransomware deployment, tampering with business data, and disruption of critical Windows services. The issue affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025, so exposure may be broad in organizations with mixed Windows estates. It is not currently listed in CISA KEV and no public exploit maturity is reported, but the high local impact and common use of privilege-escalation flaws in intrusion chains make timely patching important.

How an attack unfolds

An attacker first obtains local access to an affected Windows system, typically through phishing, stolen credentials, malicious software execution, exploitation of a separate remote-code-execution flaw, or abuse of a legitimate user session. Once running with low privileges, the attacker invokes crafted NTFS file-system operations designed to reach the vulnerable heap-buffer handling path in the NTFS driver. The malformed input causes controlled heap corruption in kernel memory. If the exploit is reliable, the attacker uses that corruption to redirect execution flow or modify kernel objects, resulting in code execution with kernel/SYSTEM privileges. After elevation, the attacker can dump credentials, install persistence, disable endpoint defenses, access protected files, move laterally, or deploy destructive payloads. Failed attempts may cause process crashes, NTFS-related errors, or system bugchecks referencing ntfs.sys.

How to fix it

Apply the applicable Microsoft security update or cumulative update for every affected Windows version as soon as it is available for the target platform. Affected products include Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Because no fixed version list was provided, use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or an equivalent patch-management platform to identify the superseding update for each OS build. Prioritize internet-facing servers, shared workstations, VDI images, jump hosts, developer workstations, file servers, and systems where untrusted users can execute code. If immediate patching is not possible, reduce risk by enforcing least privilege, blocking untrusted removable media and disk-image mounting where feasible, restricting local logon rights, limiting execution from user-writable paths, enabling endpoint protection and attack-surface-reduction rules, and monitoring for privilege-escalation behavior. Mitigations should be treated as temporary because kernel memory-corruption flaws generally require vendor patches for complete remediation.

How to confirm the fix worked

Confirm that each affected Windows endpoint or server has installed the Microsoft cumulative/security update that supersedes this vulnerability for its specific OS build. Validate through Windows Update history, WSUS/Configuration Manager/Intune compliance reports, or PowerShell inventory of installed hotfixes and OS build numbers. Confirm the patched state by comparing the installed build and ntfs.sys file version against Microsoft’s Security Update Guide for the relevant Windows release. Reboot systems where required and verify that pending reboot status is cleared. For gold images, VDI templates, offline images, and server build templates, mount or inspect the image and confirm the patched cumulative update is present before redeployment. Vulnerability scanners should be rerun after patching to ensure the host no longer reports exposure for the affected Windows version.

Typical attack path

1. Gain initial access to a Windows workstation or server using stolen credentials, malware, phishing, or another vulnerability.
2. Run attacker-controlled code locally with standard user or other low-privilege permissions.
3. Prepare crafted NTFS-related file-system input, metadata, file operations, or volume interactions that exercise the vulnerable NTFS code path.
4. Trigger the heap-based buffer overflow in the Windows NTFS driver.
5. Exploit kernel memory corruption to elevate privileges to SYSTEM or kernel context.
6. Disable security controls, harvest credentials, establish persistence, move laterally, or stage follow-on payloads such as ransomware.

How to detect it

There may be no single definitive log entry proving exploitation, because successful local kernel privilege-escalation exploits often execute in memory and then blend into normal SYSTEM activity. Review Windows System, Security, Application, Windows Error Reporting, Sysmon, EDR, and crash-dump telemetry for signs of NTFS-related instability and post-exploitation. Useful sources include System logs for bugchecks, unexpected reboots, disk or NTFS driver errors, and kernel-power events; Application logs and WER reports for crashes around the time of suspicious local activity; Security logs for unusual assignment of special privileges, new service installation, scheduled task creation, account changes, log clearing, and suspicious administrative logons; and EDR/Sysmon telemetry for processes spawning SYSTEM shells, credential-dumping tools, unsigned binaries, unexpected driver loads, and tampering with security services. Pay particular attention to sequences where a low-privilege user process is followed by an NTFS-related crash or error and then by SYSTEM-level process creation, service creation, credential access, or defense evasion. If crash dumps are available, inspect them for references to ntfs.sys and abnormal heap corruption, and preserve memory/disk artifacts before rebooting or reimaging suspected systems.

• ntfs.sys
• \\SystemRoot\\System32\\drivers\\ntfs.sys
• The computer has rebooted from a bugcheck
• Microsoft-Windows-WER-SystemErrorReporting
• Microsoft-Windows-Kernel-Power
• Microsoft-Windows-Ntfs
• Event ID 1001
• Event ID 41
• Event ID 55
• Event ID 4672
• Event ID 4688
• Event ID 4697
• Event ID 7045
• Event ID 1102
• A service was installed in the system
• Special privileges assigned to new logon
• The audit log was cleared
• WerFault.exe
• procdump.exe -ma lsass.exe
• rundll32.exe comsvcs.dll, MiniDump
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} recoveryenabled No
• wevtutil.exe cl Security
• sc.exe stop WinDefend
• powershell.exe -ExecutionPolicy Bypass

What your security team should do

• Prioritize patch deployment across affected Windows servers and workstations, especially systems used by administrators, file servers, shared endpoints, and hosts where untrusted users can run code.
• Inventory Windows 10, Windows 11, and Windows Server 2012 through 2025 assets and map them to their applicable Microsoft cumulative/security update requirements.
• Hunt for recent NTFS driver crashes, system bugchecks, unexpected privilege elevation, new services, suspicious scheduled tasks, credential-dumping activity, and security-tool tampering since publication.
• Ensure endpoint detection and response telemetry is enabled for process creation, service creation, driver loading, command-line activity, and privilege-use events.
• Apply least-privilege controls: remove unnecessary local administrator rights, restrict interactive logon to servers, and enforce privileged access workstations for administrators.
• Restrict execution from user-writable directories and apply Windows Defender Attack Surface Reduction rules where operationally feasible.
• Monitor for post-exploitation behavior rather than relying only on a vulnerability-specific exploit signature, because local kernel exploits often leave few direct artifacts when successful.
• Include patched cumulative updates in base images, deployment task sequences, VDI templates, and disaster-recovery images to avoid reintroducing vulnerable builds.