CVE-2026-45636: Windows NTFS Remote Code Execution Vulnerability

Synopsis

Heap-based buffer overflow in the Windows NTFS driver allows a local attacker to execute arbitrary code on affected Windows 10 and Windows 11 systems. The vulnerability is reached locally and requires no prior authentication, but the attacker must convince a user to open a specially crafted file or interact with a malicious NTFS volume. Successful exploitation gives the attacker full read, write, and execution control over the affected system. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows-based container images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No prior account or credential is needed to attempt exploitation (PR:N).

• Victim interactionRequired

  A local user must interact with a malicious file or NTFS volume, such as opening a crafted disk image, making this a social-engineering-dependent attack (UI:R).

• Attack complexityDetail

  Exploit reliability is high; no race conditions or special environmental conditions are required to trigger the overflow (AC:L).

Blast Radius

• A successful attacker executes arbitrary code in the context of the affected process, gaining the ability to run any program or command on the host.
• Confidentiality is fully compromised: the attacker reads any file, credential, or secret accessible on the local filesystem, including stored tokens and application data.
• Integrity is fully compromised: the attacker writes or modifies files, registry entries, and persisted application state on the host.
• Availability is fully compromised: the attacker crashes the NTFS driver or the host system, or uses code execution to disrupt or destroy running services.