CVE-2026-50402

HIGH

Microsoft Windows 10 Version 1607 - NTFS Elevation of Privilege Vulnerability

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-50402. PoCs published by SY115.

AI-analyzed exploit summary Detailed technical analysis of CVE-2026-50402, a signed/unsigned integer comparison bug in `ntfs.sys!NtfsIsBootSectorNtfs` leading to a DoS and kernel write primitive via NTFS log file replay. The writeup includes root cause analysis, patch diffs, crash dump analysis, and proof-of-concept for permission tampering through crafted VHDX files.

Description

Incorrect conversion between numeric types in Windows NTFS allows an authorized attacker to elevate privileges locally.

Exploits (1)

nomisec WRITEUP
by SY115 · poc
https://github.com/SY115/CVE-Writeups

Detailed technical analysis of CVE-2026-50402, a signed/unsigned integer comparison bug in `ntfs.sys!NtfsIsBootSectorNtfs` leading to a DoS and kernel write primitive via NTFS log file replay. The writeup includes root cause analysis, patch diffs, crash dump analysis, and proof-of-concept for permission tampering through crafted VHDX files.

Classification
Writeup 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Windows NTFS driver (ntfs.sys) in Windows 10/11/Server 2012–2025 (all supported versions as of July 2026)
No auth needed
Prerequisites: Ability to craft a malicious VHDX file with tampered NTFS boot sector and $LogFile · Admin privileges to mount the VHDX (for LPE chain; DoS works as standard user via double-click)
mistral-large-3 · analyzed Jul 19, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
NTFS Elevation of Privilege Vulnerability
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50402

Scores

CVSS v3 7.8
EPSS 0.0035
EPSS Percentile 27.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-126 CWE-681
Status published
Products (33)
Microsoft/Windows 10 Version 1607 10.0.14393.0 - 10.0.14393.9339
Microsoft/Windows 10 Version 1809 10.0.17763.0 - 10.0.17763.9020
Microsoft/Windows 10 Version 21H2 10.0.19044.0 - 10.0.19044.7548
Microsoft/Windows 10 Version 22H2 10.0.19045.0 - 10.0.19045.7548
Microsoft/Windows 11 Version 24H2 10.0.26100.0 - 10.0.26100.8875
Microsoft/Windows 11 Version 25H2 10.0.26200.0 - 10.0.26200.8875
Microsoft/Windows 11 version 26H1 10.0.28000.0 - 10.0.28000.2269
Microsoft/Windows 11 version 26H1 10.0.28000.0 - 10.0.28000.2525
Microsoft/Windows Server 2012 6.2.9200.0 - 6.2.9200.26226
Microsoft/Windows Server 2012 (Server Core installation) 6.2.9200.0 - 6.2.9200.26226
... and 23 more
Published Jul 14, 2026
Tracked Since Jul 14, 2026