CVE-2026-62887 Overview
CVE-2026-62887 is an out-of-bounds read vulnerability in the Microsoft Windows NT File System (NTFS) driver. An authorized local attacker can trigger the flaw to read memory beyond the intended buffer bounds and disclose sensitive information. The weakness maps to CWE-125: Out-of-bounds Read and requires local access with low privileges to exploit. Microsoft has published guidance through the Microsoft Security Update Guide CVE-2026-62887. The vulnerability affects a broad range of client and server Windows editions, from Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Windows Server 2025.
Critical Impact
A local, authenticated attacker can read kernel or driver memory contents through NTFS, exposing sensitive data that may aid further privilege escalation or credential theft.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
- Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-62887 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-62887
Vulnerability Analysis
The defect resides in the NTFS driver's handling of on-disk or in-memory structures. When NTFS processes certain crafted metadata, the driver reads past the end of an allocated buffer. The out-of-bounds read returns adjacent kernel or pool memory contents to the caller. Because NTFS runs in the kernel, disclosed bytes may include pointers, tokens, or file metadata belonging to other processes. The confidentiality impact is high, while integrity and availability are unaffected. Exploitation requires the attacker to already possess a local, low-privileged session on the target host, which is common in post-initial-access scenarios and shared workstation environments. The flaw is tracked under [CWE-125] and reported with an EPSS probability of 0.306%.
Root Cause
The root cause is missing or insufficient bounds validation in an NTFS parsing routine. When the driver computes a read offset or length from attacker-controllable file system input, the resulting access crosses the boundary of the source buffer. Because NTFS operates at kernel privilege, the read reaches adjacent kernel memory rather than being contained by user-mode protections.
Attack Vector
The attack vector is local. An authenticated user mounts or accesses a crafted NTFS volume, image, or virtual hard disk, or triggers a specific file system operation on an existing volume. The resulting NTFS driver call performs the over-read and returns leaked bytes to the attacker's process. No user interaction beyond the attacker's own actions is required, and the scope remains unchanged.
// No verified public proof-of-concept is available for CVE-2026-62887.
// See the Microsoft Security Update Guide reference for authoritative details.
Detection Methods for CVE-2026-62887
Indicators of Compromise
- Mounting of unexpected VHD, VHDX, or ISO files containing NTFS volumes by non-administrative users.
- Unusual process access to \\.\C: or other raw NTFS volume handles from user-mode binaries that do not normally perform file system I/O.
- Repeated NTFS driver errors or FILE_SYSTEM warnings in the Windows System event log correlated with a specific low-privileged user session.
Detection Strategies
- Hunt for DeviceIoControl calls issuing FSCTL codes such as FSCTL_READ_FILE_USN_DATA or FSCTL_GET_NTFS_FILE_RECORD from unexpected processes.
- Alert on Mount-DiskImage, Mount-VHD, or PowerShell invocations that attach disk images from user-writable directories such as %TEMP% or Downloads folders.
- Correlate file system minifilter telemetry with process ancestry to identify low-privileged users triggering NTFS metadata reads at anomalous rates.
Monitoring Recommendations
- Enable Windows Security auditing for object access (Event IDs 4656, 4663) on volume and disk image handles.
- Ingest kernel and driver crash telemetry, including WHEA and bugcheck data, into a centralized data lake for anomaly analysis.
- Track patch state across the estate to confirm the August 2026 NTFS fix has been applied on every affected Windows and Windows Server SKU.
How to Mitigate CVE-2026-62887
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide CVE-2026-62887 to all affected Windows and Windows Server systems.
- Prioritize multi-user hosts, terminal servers, VDI infrastructure, and developer workstations where low-privileged local sessions are common.
- Restrict the ability of standard users to mount arbitrary disk images (VHD, VHDX, ISO) via Group Policy or AppLocker.
Patch Information
Microsoft has issued a security update covering all listed Windows client and server versions. Refer to the Microsoft Security Update Guide CVE-2026-62887 for KB article numbers and per-SKU package identifiers. Install the update through Windows Update, Windows Server Update Services (WSUS), or your standard patch management pipeline.
Workarounds
- Enforce least privilege so that untrusted users cannot introduce attacker-controlled NTFS volumes on production hosts.
- Block execution of disk-mounting utilities for standard users through Windows Defender Application Control (WDAC) or AppLocker policies.
- Disable automatic mounting of removable media and network-attached image files on servers that do not require it.
# Group Policy path to restrict disk image mounting for standard users:
# Computer Configuration > Administrative Templates > System > Removable Storage Access
# Set: "All Removable Storage classes: Deny all access" = Enabled (where appropriate)
# Verify installed updates on Windows:
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
