CVE-2026-61350 Overview
CVE-2026-61350 is a buffer over-read vulnerability in the Windows NTFS file system driver. An unauthorized attacker with physical access to a target system can trigger the flaw to disclose sensitive information from adjacent kernel memory. The issue affects a broad range of Microsoft desktop and server operating systems, from Windows 10 1607 through Windows 11 26H1, and from Windows Server 2012 through Windows Server 2025. The vulnerability is classified under CWE-126: Buffer Over-read and requires physical interaction with the device, which limits large-scale remote exploitation.
Critical Impact
An attacker with physical access can read out-of-bounds NTFS memory to disclose confidential data stored in kernel structures, without needing authentication or user interaction.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on x64 and ARM64
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61350 published to the National Vulnerability Database
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61350
Vulnerability Analysis
The flaw resides in the New Technology File System (NTFS) driver that ships with all supported versions of Windows. NTFS parses on-disk metadata structures such as the Master File Table (MFT), file records, and attribute headers when a volume is mounted or a file is accessed. When the driver processes a maliciously crafted NTFS volume, it reads past the intended end of a buffer, exposing adjacent memory to the caller. Because NTFS runs in kernel context, the disclosed bytes can include pool contents, pointers, or fragments of file data from other processes. The confidentiality impact is high, while integrity and availability are unaffected.
Root Cause
The defect is a classic buffer over-read described by CWE-126. The NTFS driver trusts a length or offset field encoded inside attacker-controlled file system metadata and uses it to iterate or copy a structure without validating that the computed extent stays within the allocated buffer. When the length exceeds the buffer, the driver returns data from neighbouring memory.
Attack Vector
Exploitation requires physical access to the target host. An attacker connects a USB drive, memory card, or external disk formatted with a crafted NTFS volume, or boots the machine from removable media. When Windows auto-mounts the volume and NTFS parses its structures, the over-read triggers and data is returned to the attacker through error output, log data, or subsequent file operations under attacker control. No user credentials are required, and no user interaction beyond attaching the media is needed.
No public proof-of-concept or exploit code has been published for CVE-2026-61350. See the Microsoft CVE-2026-61350 Update Guide for authoritative technical details.
Detection Methods for CVE-2026-61350
Indicators of Compromise
- Unexpected mount events for removable NTFS volumes on kiosk, lab, or unattended endpoints, especially outside business hours.
- NTFS driver errors or ntfs.sys warnings in the System event log correlated with the insertion of external storage.
- USB or storage device connection events from unrecognized vendor IDs on systems that do not normally use removable media.
Detection Strategies
- Monitor Windows Event Log channels Microsoft-Windows-Kernel-PnP and Microsoft-Windows-Ntfs/Operational for anomalous volume mount activity paired with driver errors.
- Correlate physical login or console session events with mass storage device attachment to identify unauthorized physical access attempts.
- Alert on repeated NTFS parsing failures on a single host, which may indicate probing with malformed volumes.
Monitoring Recommendations
- Enable USB and removable media auditing through Group Policy and forward the logs to a central SIEM for long-term retention.
- Track patch compliance across all Windows 10, Windows 11, and Windows Server systems listed in the affected products section.
- Review physical security telemetry, including badge access and camera logs, for endpoints handling sensitive data.
How to Mitigate CVE-2026-61350
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft CVE-2026-61350 Update Guide to all affected Windows client and server builds.
- Restrict physical access to endpoints, particularly shared workstations, kiosks, and servers that do not reside in controlled data-center space.
- Disable AutoPlay and AutoRun for removable media through Group Policy to reduce automatic NTFS parsing of untrusted volumes.
Patch Information
Microsoft has released fixes as part of its regular Patch Tuesday cycle. Administrators should consult the Microsoft CVE-2026-61350 Update Guide for the specific KB article and build numbers applicable to each affected version, and validate deployment through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.
Workarounds
- Use device control or endpoint policy to block unauthorized USB mass storage and external disks on high-risk systems until patches are deployed.
- Enforce BitLocker with pre-boot authentication so that untrusted media cannot be mounted before user login on lost or stolen devices.
- Configure Windows to require administrator approval before mounting new removable volumes on servers and privileged workstations.
# Disable AutoPlay for all drive types via registry (run as administrator)
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 0xFF /f
# Block USB mass storage devices system-wide
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
