CVE-2026-72935: Windows NTFS Privilege Escalation Vulnerability

CVE-2026-72935 Overview

CVE-2026-72935 is an out-of-bounds read vulnerability [CWE-125] in the Windows New Technology File System (NTFS) driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. The issue requires local access and high privileges to trigger, but successful exploitation compromises confidentiality, integrity, and availability of the host. Microsoft published guidance for this vulnerability through its security update guide.

Critical Impact
Successful exploitation allows a local authorized attacker to read out-of-bounds kernel memory through NTFS and elevate privileges on the target Windows system.

Affected Products

Microsoft Windows (NTFS driver component)
Refer to the Microsoft CVE-2026-72935 Update Guide for specific affected Windows versions and builds
Systems running unpatched Windows client and server editions with NTFS volumes

Discovery Timeline

2026-09-08 - CVE-2026-72935 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72935

Vulnerability Analysis

The vulnerability resides in the Windows NTFS driver, which parses on-disk file system structures in kernel mode. An out-of-bounds read occurs when the driver reads memory beyond the intended buffer boundary while processing NTFS metadata. Because NTFS runs in kernel context, disclosed memory can include sensitive kernel data structures usable to bypass mitigations such as Kernel Address Space Layout Randomization (KASLR).

An attacker who already holds valid, high-privilege credentials on the system can chain the memory disclosure with additional primitives to escalate to SYSTEM. The attack does not require user interaction. Exploitation is constrained to local vectors, so remote exploitation without prior code execution on the host is not applicable.

Root Cause

The root cause is missing or insufficient bounds checking when the NTFS driver reads structured data from a file system object. When a specially crafted NTFS structure is processed, the driver dereferences an offset or length field that extends beyond the allocated buffer. This condition maps to CWE-125 (Out-of-bounds Read) and results in kernel memory disclosure.

Attack Vector

Exploitation requires local access with high privileges on the target system. A typical attack path involves an authorized user mounting or interacting with a crafted NTFS volume, virtual hard disk (VHD/VHDX), or file system image that triggers the vulnerable parsing path. Consult the Microsoft Security Response Center advisory for authoritative details on the affected code path and preconditions.

Detection Methods for CVE-2026-72935

Indicators of Compromise

Unexpected mounts of user-supplied VHD, VHDX, or ISO images containing NTFS volumes on production hosts
NTFS driver errors, bugchecks, or STOP events (for example, NTFS_FILE_SYSTEM) correlating with user-mode activity from non-administrative workflows
New processes running as SYSTEM spawned shortly after a low-integrity user interacted with an unusual disk image

Detection Strategies

Monitor Windows event logs for Ntfs source errors and kernel-mode faults that follow file system mount operations
Detect anomalous invocations of Mount-DiskImage, Mount-VHD, or PowerShell cmdlets that attach disk images from user-writable directories
Correlate token elevation events (Event ID 4672) with prior file system driver anomalies to surface potential privilege escalation chains

Monitoring Recommendations

Enable and forward Windows Kernel and NTFS operational logs to a centralized SIEM for retention and correlation
Baseline legitimate disk image mounting activity so that outlier events on servers and workstations are visible
Track patch compliance for the Microsoft security update addressing CVE-2026-72935 across the fleet

How to Mitigate CVE-2026-72935

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-72935 to all affected Windows systems
Prioritize patching multi-user systems, terminal servers, and hosts where non-administrative users can execute code
Audit local administrative and high-privilege accounts to reduce the population of users able to reach the vulnerable code path

Patch Information

Microsoft has published remediation guidance in the security update guide. Administrators should install the corresponding cumulative update for each affected Windows version. Verify installation by cross-referencing the KB article listed in the MSRC advisory with Get-HotFix output on target hosts.

Workarounds

Restrict the ability of standard and privileged users to mount arbitrary disk images (VHD, VHDX, ISO) through Group Policy and application control
Enforce least privilege by removing unnecessary local administrator rights that satisfy the high-privilege precondition for exploitation
Use application allow-listing (for example, Windows Defender Application Control) to block untrusted tooling that could stage crafted NTFS images

bash

# Configuration example: verify the Microsoft update for CVE-2026-72935 is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Restrict non-administrators from mounting VHD/VHDX files via Group Policy
# Computer Configuration > Administrative Templates > System > Removable Storage Access
# Set: 'All Removable Storage classes: Deny all access' where operationally acceptable