CVE-2026-83995: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-83995 Overview

CVE-2026-83995 is a heap-based buffer overflow [CWE-122] in the Windows NTFS file system driver. An authorized local attacker can trigger the overflow to corrupt kernel heap memory and elevate privileges on the affected host. Microsoft published the advisory on September 8, 2026, covering supported client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025. The flaw requires only low privileges and no user interaction, and successful exploitation compromises confidentiality, integrity, and availability of the operating system.

Critical Impact
A local, authenticated attacker can gain SYSTEM-level privileges by corrupting the NTFS driver heap, breaking the standard user boundary on every currently supported Windows release.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 builds
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-83995 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-83995

Vulnerability Analysis

The vulnerability resides in the NTFS driver (ntfs.sys), which parses on-disk metadata structures such as the Master File Table (MFT), attribute lists, and index records. A heap-based buffer overflow [CWE-122] occurs when the driver allocates a pool buffer based on one field of a file system structure and then copies data using a length derived from a different, attacker-influenced field. Because NTFS runs in kernel mode, the resulting out-of-bounds write corrupts kernel pool memory and can be shaped into arbitrary code execution or token replacement.

Exploitation requires local access and low privileges, which aligns with a standard user mounting or accessing a crafted volume. The attack does not require user interaction beyond triggering the file system operation that parses the malformed metadata.

Root Cause

The root cause is missing or inconsistent bounds validation between the allocated destination buffer size and the length of NTFS metadata being copied into it. When a crafted volume or file record supplies oversized or mismatched attribute lengths, the driver writes past the end of the pool allocation, corrupting adjacent kernel objects.

Attack Vector

A local attacker mounts or opens a maliciously crafted NTFS volume, such as a VHD, VHDX, ISO, or removable disk image, that contains malformed metadata. When the NTFS driver parses the structure, the overflow is triggered in kernel context. By grooming the kernel pool and overwriting a controlled object, the attacker can escalate the running process token to SYSTEM. No verified proof-of-concept code is publicly available at the time of publication.

// No public proof-of-concept is available for CVE-2026-83995.
// Refer to the Microsoft Security Response Center advisory for
// technical details once additional information is released.

Detection Methods for CVE-2026-83995

Indicators of Compromise

Unexpected mounting of VHD, VHDX, or ISO images by non-administrative users, particularly from user-writable directories such as %TEMP% or download folders.
Bugchecks referencing ntfs.sys (for example KERNEL_MODE_HEAP_CORRUPTION or SYSTEM_SERVICE_EXCEPTION) shortly after a volume mount or file access operation.
Standard user processes suddenly running with SYSTEM integrity, or spawning cmd.exe or powershell.exe as SYSTEM without a legitimate parent service.

Detection Strategies

Monitor for Microsoft-Windows-VHDMP and virtual disk service events (Event IDs 1, 2, 12) that correlate with non-administrative account activity.
Alert on kernel pool corruption crashes attributed to ntfs.sys in Windows Error Reporting or WHEA logs.
Track process token elevation events where a child process inherits SYSTEM privileges from a parent running at Medium integrity.

Monitoring Recommendations

Enable Sysmon Event ID 1 with command-line logging and Event ID 10 for process access, focused on lsass.exe and winlogon.exe targets from newly elevated processes.
Forward crash dumps and kernel event logs to a centralized data lake for retroactive hunting across the fleet.
Baseline legitimate use of mountable disk images in the environment and alert on deviations.

How to Mitigate CVE-2026-83995

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft CVE-2026-83995 Update Guide to all affected Windows client and server builds.
Prioritize patching of multi-user systems, jump hosts, terminal servers, and virtual desktop infrastructure where local users routinely operate.
Audit endpoints for accounts with interactive logon rights and remove unnecessary local access to reduce the exploitable population.

Patch Information

Microsoft has published fixed builds through the September 2026 update cycle. Consult the Microsoft CVE-2026-83995 Update Guide for the specific KB article and build number that corresponds to each affected release, including Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Workarounds

Restrict the ability of standard users to mount arbitrary disk images by disabling or restricting the Virtual Disk Service and blocking double-click mounting of .vhd, .vhdx, and .iso files via Group Policy or file association hardening.
Enforce device control policies that prevent unapproved USB and removable storage from being attached to sensitive endpoints.
Constrain local logon rights and enforce least privilege to shrink the set of accounts that meet the local, low-privilege precondition.

bash

# Example: Group Policy setting to block users from mounting ISO/VHD files
# Computer Configuration > Administrative Templates > System > Removable Storage Access
# Set "All Removable Storage classes: Deny all access" = Enabled
# And restrict shell mount handlers via registry:
reg add "HKCR\Windows.IsoFile\shell\mount" /v "LegacyDisable" /t REG_SZ /d "" /f
reg add "HKCR\Windows.VhdFile\shell\mount" /v "LegacyDisable" /t REG_SZ /d "" /f