CVE-2026-65784 Overview
CVE-2026-65784 is an out-of-bounds read vulnerability in the Windows NTFS file system driver. The flaw allows an authenticated local attacker to read memory contents beyond the intended buffer boundaries, resulting in information disclosure. The issue is tracked under CWE-125 (Out-of-bounds Read) and affects a broad range of Windows client and server operating systems. Microsoft published guidance for this issue in the Microsoft Security Update Guide.
Critical Impact
An authorized local attacker can read adjacent kernel memory through NTFS, potentially exposing sensitive data such as file system metadata, cached credentials, or other kernel structures useful for further exploitation.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) across x64 and ARM64 architectures
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-65784 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-65784
Vulnerability Analysis
The vulnerability resides in the NTFS driver, the kernel-mode component that implements the New Technology File System on Windows. NTFS parses complex on-disk structures including Master File Table (MFT) records, attributes, index entries, and reparse points. When the driver processes one of these structures without validating that a length or offset field remains within the allocated buffer, it reads memory outside the intended bounds.
Exploitation requires local access and low privileges, with no user interaction needed. A successful read exposes kernel memory contents to the attacker but does not modify integrity or availability. The disclosed data may include portions of file metadata, driver state, or unrelated kernel allocations residing near the target buffer.
Root Cause
The root cause is missing or incorrect bounds validation during NTFS structure parsing, classified as CWE-125. A crafted NTFS artifact — such as a malformed volume, image, or attribute record — causes the driver to compute a read offset that exceeds the buffer length. The driver then returns memory bytes that belong to adjacent kernel objects.
Attack Vector
An authenticated attacker triggers the vulnerability locally by supplying a specially crafted NTFS file system structure. Common delivery methods for NTFS-parsing bugs include mounting a malicious VHD or ISO image, plugging in a rogue USB device with a crafted NTFS volume, or invoking file system APIs against a manipulated file. Because the attack vector is local and requires low privileges, exploitation typically follows initial access on the host.
No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.306%, reflecting a low probability of exploitation in the near term.
Detection Methods for CVE-2026-65784
Indicators of Compromise
- Unexpected mounting of virtual disk files (.vhd, .vhdx, .iso) by non-administrative users or unusual processes
- Repeated NTFS driver errors or Ntfs event log entries referencing corrupt or malformed volume structures
- Attachment of unknown removable media containing NTFS volumes on systems where such usage is not routine
Detection Strategies
- Monitor Windows event logs for Ntfs source errors (event IDs 55, 130, 137) that may indicate malformed structures being parsed
- Alert on invocations of Mount-DiskImage, Mount-VHD, or the VirtualDiskService from user contexts that do not normally use these operations
- Correlate file system driver anomalies with recent user logon events to identify low-privilege accounts probing NTFS parsing behavior
Monitoring Recommendations
- Enable Windows kernel and driver telemetry collection, forwarding events to a centralized analytics platform for behavioral correlation
- Track process ancestry for tools that mount disk images or interact with raw volumes, especially when executed by standard users
- Review Sysmon FileCreate and DriverLoad events for suspicious NTFS-related activity across the fleet
How to Mitigate CVE-2026-65784
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-65784 as soon as it is available for the affected build
- Prioritize patching on multi-user systems, terminal servers, and hosts where untrusted users can log on interactively
- Restrict local logon rights to only the accounts that require them, reducing the population of potential attackers
Patch Information
Microsoft has issued vendor guidance through the Microsoft Security Response Center. Administrators should consult the Microsoft advisory for CVE-2026-65784 to identify the specific KB article for each affected build of Windows 10, Windows 11, and Windows Server, then deploy through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.
Workarounds
- Disable auto-mounting of removable media and virtual disk files via Group Policy where operationally feasible
- Block standard users from mounting VHD and ISO files through AppLocker or Windows Defender Application Control policies
- Enforce least privilege and remove local administrator rights from end-user accounts to limit the impact of chained exploitation
# Example: disable automatic mounting of new volumes using diskpart
diskpart
automount disable
automount scrub
exit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
