CVE-2026-83995

Windows NTFS contains a heap-based buffer overflow (CWE-122) that allows a local, authorized attacker to elevate privileges on the affected machine. An attacker who already has a low-privileged foothold can trigger the overflow through NTFS filesystem activity, corrupting driver memory. Successful exploitation yields elevated (kernel/SYSTEM-level) access, with high impact on confidentiality, integrity, and availability per the CVSS vector. All currently supported Windows 10 and Windows 11 client branches and Windows Server 2012 through 2022 are affected, so essentially every supported Windows desktop and server is in scope. The flaw is fixed in Microsoft's September 2026 Patch Tuesday (which addressed 973 vulnerabilities), but it is not identified among the two exploited zero-days in that release; there is no known in-the-wild exploitation, no public proof-of-concept, and EPSS estimates only a 0.3% chance of exploitation within 30 days.

What to do: Apply Microsoft's September 2026 cumulative/security updates to every affected Windows 10, Windows 11, and Windows Server system, checking Microsoft's CVE-2026-83995 advisory for the correct KB for each branch. Prioritize hosts where untrusted users have local access — shared workstations, kiosks, VDI, and multi-user servers — because this flaw lets a low-privileged user gain elevated rights and can be chained with other user-level compromises. Confirm remediation through your patch management reporting, since no workaround is indicated in the available data.