CVE-2026-58640

What it actually does

This vulnerability is a heap-based buffer overflow in the Windows NTFS file system handling code. A low-privileged, authenticated local attacker can trigger memory corruption when Windows processes specially crafted NTFS content, potentially allowing arbitrary code execution in the local system context or in a privileged kernel-adjacent execution path depending on the vulnerable code path. The CVSS vector indicates local access, low attack complexity, low privileges required, and required user interaction, with high confidentiality, integrity, and availability impact. Successful exploitation could therefore support local privilege escalation, security control bypass, tampering with files or system state, credential access, or system crash.

Why it matters to the business

If exploited, this flaw can let an attacker who already has limited access to a Windows workstation or server gain much higher control over that system. In practical terms, it can turn an initial foothold into full device compromise, enabling data theft, malware deployment, lateral movement, or disruption of business operations. The vulnerability affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025, so exposure may be broad across enterprise endpoint and server fleets. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at this time, but local privilege escalation issues are commonly chained with phishing, malware execution, or remote access compromise.

How an attack unfolds

An attacker first obtains low-privileged local access to a Windows system, such as through stolen credentials, malware execution, interactive login, remote desktop access, or compromise of an unprivileged user account. The attacker then causes Windows to process attacker-controlled NTFS data, likely through a crafted file system object, disk image, removable media, virtual disk, archive-extracted content, or another workflow that reaches the vulnerable NTFS parsing or handling path. Because user interaction is required, exploitation may involve convincing a user to open, mount, attach, browse, or otherwise interact with malicious content. When the vulnerable NTFS code processes the malformed structure, a heap buffer overflow occurs. With a reliable exploit, the attacker can corrupt memory in a controlled way and execute code locally with elevated privileges or otherwise gain control over the affected system. After exploitation, the attacker may disable security tools, dump credentials, install persistence, move laterally, or stage ransomware or data-theft tooling.

How to fix it

Apply the Microsoft security update that addresses this NTFS heap-based buffer overflow for all affected Windows versions as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Microsoft Configuration Manager, or the organization’s endpoint management platform. Because no exact fixed build numbers were provided, verify remediation against Microsoft’s official advisory and the cumulative update level for each affected Windows release. Prioritize internet-exposed management hosts, shared workstations, administrator workstations, VDI images, jump servers, file servers, backup servers, and systems where untrusted removable media, virtual disks, archives, or disk images may be handled. Where immediate patching is not possible, reduce risk by blocking or tightly controlling the use of untrusted removable storage, virtual disk mounting, downloaded disk images, and archive workflows that may expose NTFS content; enforce least privilege; restrict local interactive logon; remove unnecessary local administrator rights; and ensure endpoint detection and response controls are active. Harden systems with attack surface reduction rules, controlled folder access where appropriate, application control, and credential protection features such as LSASS protection and Credential Guard.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant Microsoft cumulative security update for this vulnerability. Validate through centralized patch reporting, Windows Update history, installed hotfix inventory, Microsoft Update Compliance, WSUS, Configuration Manager, Intune, or endpoint management tooling. On individual systems, use commands such as `winver`, `systeminfo`, `wmic qfe list`, or PowerShell `Get-HotFix` and compare the installed cumulative update or OS build to Microsoft’s official fixed release information. Confirm that golden images, offline images, VDI pools, recovery images, and server templates are also updated. For exposure validation, identify systems that allow users to mount virtual disks, attach removable media, process downloaded disk images, or interact with untrusted archives. Where feasible, test that untrusted removable media and disk image mounting restrictions are enforced for non-administrative users. Do not validate by running public exploit code on production systems.

Typical attack path

1. Gain low-privileged access to a Windows client or server, or deliver malicious content to a signed-in user.
2. Prepare specially crafted NTFS-related content designed to trigger the heap buffer overflow.
3. Induce required user interaction, such as opening, mounting, attaching, browsing, or otherwise processing the crafted content.
4. Trigger the vulnerable NTFS code path and corrupt heap memory.
5. Execute attacker-controlled code locally or escalate privileges on the affected system.
6. Use the elevated access to dump credentials, alter files, disable defenses, install persistence, or move laterally.

How to detect it

To determine whether exploitation has already occurred, correlate endpoint telemetry, Windows event logs, and EDR data around suspicious processing of storage media or disk images followed by privilege escalation or post-exploitation behavior. Review Microsoft-Windows-Kernel-PnP, Microsoft-Windows-DriverFrameworks-UserMode/Operational, Microsoft-Windows-Partition/Diagnostic, Microsoft-Windows-Ntfs/Operational where available, Security logs, PowerShell logs, Sysmon logs, and EDR process/file/module telemetry. Look for unusual mounting or attachment of removable media, VHD/VHDX/ISO/IMG files, unexpected NTFS errors or crashes, abnormal child processes spawned after file browsing or mount activity, and low-privileged user processes that quickly lead to service creation, scheduled task creation, credential access, driver loading, or security tool tampering. Investigate Windows Error Reporting events, bugchecks, application crashes, or system instability involving file-system activity, especially if followed by privilege changes or new persistence. Because no public exploit maturity or known threat actor use is reported, detection should focus on behavioral chains rather than a single signature: user interaction with suspicious storage content, memory corruption symptoms, then elevated execution or post-compromise activity. Also review EDR alerts for local privilege escalation, token theft, suspicious handle access to LSASS, new local administrator membership, and lateral movement originating from systems that recently handled untrusted media or disk images.

What your security team should do

• Track Microsoft’s official advisory and deploy the applicable cumulative security updates across affected Windows 10, Windows 11, and Windows Server systems.
• Prioritize patching systems used by administrators, shared endpoints, VDI pools, file servers, backup infrastructure, and systems that process removable media or virtual disk images.
• Inventory and restrict the ability of standard users to mount or open untrusted VHD, VHDX, ISO, IMG, and removable-media content where business operations allow.
• Hunt for suspicious local privilege escalation behavior following interaction with disk images, removable media, or unusual file-system artifacts.
• Review endpoint telemetry for low-privileged processes spawning administrative tools, credential-dumping utilities, PowerShell, cmd.exe, rundll32.exe, regsvr32.exe, wmic.exe, or service-creation activity shortly after mounting or browsing external media or disk images.
• Ensure EDR, antivirus, tamper protection, LSASS protection, and attack surface reduction policies are enabled and monitored.
• Remove unnecessary local administrator rights and enforce least privilege to limit post-exploitation impact.
• Update incident response playbooks for local privilege escalation chained after phishing, malware execution, or compromised user access.