CVE-2026-56175

Windows NTFS Elevation of Privilege Vulnerability

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.

Analysis

AI-generated

Technical impact

A heap-based buffer overflow exists in the Windows NTFS file system, allowing an authorized local user to elevate privileges.

Affected Systems

The flaw affects Microsoft Windows platforms, specifically Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, covering both core and non‑core installations across x86, x64, and ARM architectures.

Risk and Exploitability

The CVSS base score of 7.8 indicates high severity due to the potential for local privilege escalation. Exploitation requires local authorization, reducing the likelihood of widespread attacks; the EPSS score of less than 1 % confirms a currently very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, privileged attackers who are able to execute code on the target system remain a serious threat, and the high impact combined with the local attack vector makes patching and monitoring essential.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the official Microsoft update that addresses the NTFS heap‑based buffer overflow flaw (refer to the Microsoft Security Response Center guidance).
  • Limit local user accounts to the minimum privileges required and disable or restrict any services that process untrusted NTFS files until the patch is applied.
  • Deploy endpoint detection and response solutions to monitor for anomalous NTFS activity and enforce file integrity checks until the vulnerability is remediated.

Generated by OpenCVE AI on August 1, 2026 at 09:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2012 (server Core Installation)
Microsoft windows Server 2012 R2
Microsoft windows Server 2012 R2 (server Core Installation)
Microsoft windows Server 2016 (server Core Installation)
Microsoft windows Server 2019 (server Core Installation)
Microsoft windows Server 2025 (server Core Installation)
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally.
Title Windows NTFS Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-122
CPEs cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 10 1607
Microsoft windows 10 1809
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2012
Microsoft windows Server 2012 R2
Microsoft windows Server 2016
Microsoft windows Server 2019
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}
Weaknesses
  • CWE-122

    Heap-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
microsoft
Published
Updated
Nov 10, 2026, 10:39 PM
Reserved
Jun 19, 2026, 1:53 PM

View source JSON

Updated
Jul 15, 2026, 10:54 AM

JSON

Status
Analyzed
Published
Jul 14, 2026, 6:18 PM
Modified
Jul 22, 2026, 11:49 AM

View source JSON

No data.

Updated
Aug 7, 2026, 10:15 AM

JSON