Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 13 products
| Date | Total | Labels |
|---|
| 2026-07-15 | 2 | Patch2 |
| 2026-07-27 | 1 | Patch1 |
| 2026-08-17 | 1 | Patch1 |
Another Patch Tuesday, another batch of NTFS vulnerabilities fixed. My contribution this time included CVE-2026-58640, CVE-2026-50471, and CVE-2026-50494. Im also surprised to see that someone else is interested in NTFS besides me :)
Post summary
The post announces that a Patch Tuesday update fixed three NTFS-related CVEs, with no details on exploitation, PoC, or technical specifics.
Three NTFS heap overflows in ntfs.sys, all triggerable via a single malicious VHD file, patched July 2026 across roughly 30 Windows client and server editions. No public PoC confirmed yet, but the forensic window before patching deserves scrutiny. - CVE-2026-50471 (CVSS 7.8), CVE-2026-50494 (CVSS 7.8), and CVE-2026-58640 (CVSS 7.3) all share the same CWE-122 root cause: ntfs.sys allocates a heap buffer using one size, writes using a mismatched length, corrupting adjacent kernel pool memory. CVE-2026-50494 is the most dangerous operationally as it requires only local low-privilege access with no user interaction to escalate to SYSTEM. The other two need a user to open the file, a trivial social engineering bar given VHD has no "are you sure" prompt on double-click since Windows 8. - The delivery chain is deliberately low-friction. Windows Explorer auto-mounts a VHD like a ZIP archive. Attackers can deliver it via email, chat, or cloud link with a plausible backup or disk image cover story. APT-C-60 already used VHDX as an attack vector in a documented campaign analyzed by Positive Technologies. - NTFS itself logs the attack. The USN Journal ($Extend\$UsnJrnl) retains create, rename, and delete events for roughly 20 days even after the VHD is removed. The $LogFile records low-level metadata transactions that can show heap corruption fingerprints even without a system crash. #DFIR_Radar
Post summary
The post reports three NTFS heap overflow vulnerabilities, describes their exploitation mechanism via a malicious VHD file, notes the July 2026 patch, and highlights forensic considerations yet confirms no public PoC or evidence of active attacks.
Microsoft shipped 560+ CVE fixes in July. One is CVE-2026-58640, a code execution flaw in Windows NTFS. Reading the advisory takes two minutes. Knowing which of your 90 Windows endpoints took the update takes an afternoon. That gap is the actual risk. #PatchTuesday #ITAdmin https://t.co/yeV5xdx9s7
Post summary
Microsoft released a patch for CVE‑2026‑58640, a code‑execution flaw in Windows NTFS, although tracking which endpoints applied the update remains a challenge.
🪟 NTFS can turn a booby-trapped file or USB drive into code execution across Windows 10, 11, and Server. “Remote” or not, July’s update is less optional than the reboot reminder. https://windowsforum.com/threads/cve-2026-58640-patch-windows-ntfs-rce-in-july-14-updates.438304/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #NtfsVulnerability #PatchTuesday #Cve202658640 https://t.co/dTlJJv7L2e
Post summary
The post highlights that CVE-2026-58640 is an NTFS-based RCE affecting Windows 10/11/Server, and urges users to apply the July update patch.
24 of 24 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | arm64 |
| OS | microsoft | windows_10_21h2 | - | - | x64 |
| OS | microsoft | windows_10_21h2 | - | - | x86 |
| OS | microsoft | windows_10_22h2 | - | - | arm64 |
| OS | microsoft | windows_10_22h2 | - | - | x64 |
| OS | microsoft | windows_10_22h2 | - | - | x86 |
| OS | microsoft | windows_11_23h2 | - | - | arm64 |
| OS | microsoft | windows_11_23h2 | - | - | x64 |
| OS | microsoft | windows_11_24h2 | - | - | arm64 |
| OS | microsoft | windows_11_24h2 | - | - | x64 |
| OS | microsoft | windows_11_25h2 | - | - | arm64 |
| OS | microsoft | windows_11_25h2 | - | - | x64 |
| OS | microsoft | windows_11_26h1 | - | - | arm64 |
| OS | microsoft | windows_11_26h1 | - | - | x64 |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | - |