Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 12 products
| Date | Total | Labels |
|---|
| 2026-07-15 | 2 | Disclosure1Patch1 |
| 2026-08-17 | 1 | Patch1 |
Another Patch Tuesday, another batch of NTFS vulnerabilities fixed. My contribution this time included CVE-2026-58640, CVE-2026-50471, and CVE-2026-50494. Im also surprised to see that someone else is interested in NTFS besides me :)
Post summary
The author participates in Patch Tuesday by fixing a set of NTFS vulnerabilities (CVE-2026-58640, CVE-2026-50471, CVE-2026-50494), confirming that patches have been applied.
Three NTFS heap overflows in ntfs.sys, all triggerable via a single malicious VHD file, patched July 2026 across roughly 30 Windows client and server editions. No public PoC confirmed yet, but the forensic window before patching deserves scrutiny. - CVE-2026-50471 (CVSS 7.8), CVE-2026-50494 (CVSS 7.8), and CVE-2026-58640 (CVSS 7.3) all share the same CWE-122 root cause: ntfs.sys allocates a heap buffer using one size, writes using a mismatched length, corrupting adjacent kernel pool memory. CVE-2026-50494 is the most dangerous operationally as it requires only local low-privilege access with no user interaction to escalate to SYSTEM. The other two need a user to open the file, a trivial social engineering bar given VHD has no "are you sure" prompt on double-click since Windows 8. - The delivery chain is deliberately low-friction. Windows Explorer auto-mounts a VHD like a ZIP archive. Attackers can deliver it via email, chat, or cloud link with a plausible backup or disk image cover story. APT-C-60 already used VHDX as an attack vector in a documented campaign analyzed by Positive Technologies. - NTFS itself logs the attack. The USN Journal ($Extend\$UsnJrnl) retains create, rename, and delete events for roughly 20 days even after the VHD is removed. The $LogFile records low-level metadata transactions that can show heap corruption fingerprints even without a system crash. #DFIR_Radar
Post summary
The post details three NTFS heap overflow CVEs that were patched in July 2026, notes active exploitation by APT-C-60 using VHD files, and confirms no public PoC yet.
🪟 Microsoft calls it “remote” code execution; the details say local. Either way, NTFS just found another way to turn “open a file” into “patch Tuesday panic.” Update now. https://windowsforum.com/threads/cve-2026-50494-patch-windows-ntfs-local-code-execution-bug.438579/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PatchManagement #NtfsVulnerability #Cve202650494 https://t.co/sahRlCl7Qm
Post summary
Microsoft discloses a new NTFS local/remote code‑execution flaw (CVE‑2026‑50494) and urges users to apply the patch as part of Patch Tuesday.
22 of 22 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | - |