CVE-2026-62793 Overview
CVE-2026-62793 is a buffer over-read vulnerability in the Windows New Technology File System (NTFS) driver. An authenticated local attacker can read memory contents beyond the intended buffer boundary, leading to information disclosure. The flaw is tracked under [CWE-126: Buffer Over-read] and affects supported Windows client and Windows Server editions. Microsoft published the advisory on 2026-08-11 through the Microsoft Security Update CVE-2026-62793 guidance. Exploitation requires local access and low-privilege authentication, and no user interaction is necessary. The vulnerability impacts confidentiality only; integrity and availability of the system are not directly affected.
Critical Impact
A local, authenticated attacker can read out-of-bounds NTFS memory, exposing sensitive kernel or file system data that may aid further attacks such as privilege escalation.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62793 published to NVD and Microsoft releases security guidance
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62793
Vulnerability Analysis
The flaw resides in the NTFS driver, which parses on-disk file system structures and services file operations for local processes. A buffer over-read occurs when the driver reads past the allocated end of a buffer while processing NTFS metadata or user-controlled input. The attacker requires local access and valid low-privilege credentials to trigger the code path. Because the read touches adjacent kernel memory, contents can include pointers, tokens, or cached file data. The disclosed bytes can be exfiltrated to user mode through a driver response or IOCTL result. The vulnerability does not permit modification of data or denial of service, keeping the impact focused on confidentiality.
Root Cause
The root cause is missing or incorrect boundary validation in NTFS parsing logic, aligning with [CWE-126: Buffer Over-read]. The driver computes a read length based on attacker-influenced metadata without confirming the length remains within the source buffer. Sequential reads then extend past the allocation into adjacent memory. Microsoft has not published the exact function or code path in the public advisory.
Attack Vector
The attack vector is local. An authorized user runs code that issues crafted file system operations against a specially prepared NTFS volume or file. This can include mounting a malicious VHD or interacting with a crafted directory entry, reparse point, or attribute record. The read result is returned to the caller, which extracts the leaked bytes.
No public proof-of-concept exploit is available. Refer to the Microsoft Security Update CVE-2026-62793 advisory for the definitive technical description.
Detection Methods for CVE-2026-62793
Indicators of Compromise
- Mounting of unexpected or untrusted VHD, VHDX, or ISO images by non-administrative users.
- Unusual volumes of NTFS-related IOCTLs or file system control requests from user processes.
- Presence of unsigned or unknown binaries that programmatically parse NTFS metadata or attach virtual disks.
Detection Strategies
- Alert on process creation events invoking diskpart.exe, mountvol.exe, or PowerShell Mount-DiskImage from standard user accounts.
- Correlate local logon events with subsequent file system driver interactions targeting freshly attached volumes.
- Baseline expected NTFS driver call patterns per host and flag deviations that align with volume attach or reparse-point manipulation activity.
Monitoring Recommendations
- Enable kernel and file system auditing on servers with multi-user access and shared storage endpoints.
- Forward Windows Security, Sysmon, and EDR telemetry to a centralized data lake for retention and correlation.
- Track patch compliance for the August 2026 Windows security updates across all Windows client and Server assets.
How to Mitigate CVE-2026-62793
Immediate Actions Required
- Apply the August 2026 Microsoft security updates referenced in the Microsoft Security Update CVE-2026-62793 advisory to all affected Windows and Windows Server systems.
- Prioritize multi-user hosts, terminal servers, and jump hosts where local users can execute code.
- Restrict the ability of standard users to mount arbitrary disk images or attach removable media.
Patch Information
Microsoft has issued cumulative updates addressing CVE-2026-62793 for all supported Windows 10, Windows 11, and Windows Server versions. Consult the Microsoft Security Update CVE-2026-62793 guidance for the specific KB article and build numbers per operating system.
Workarounds
- Remove the Create symbolic links and disk-mounting privileges from non-administrative accounts via Group Policy.
- Block attachment of user-supplied VHD/VHDX/ISO files through application control policies such as Windows Defender Application Control or AppLocker.
- Enforce least-privilege access on shared and multi-tenant systems to reduce the pool of users who can trigger the vulnerable code path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
