OTPulse

Windows NTFS Information Disclosure Vulnerability

MonitorCVSS 5.5CVE-2026-62887Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows NTFS allows an authorized local user to disclose information by reading memory that should not be accessible. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), Windows Server 2016, 2019, 2022, and 2025 across all supported architectures (32-bit, x64, ARM64).

What this means
What could happen
An attacker with local access to a Windows system can read sensitive data from NTFS filesystem memory that should not be accessible, such as file content or system information.
Who's at risk
Windows administrators managing Windows 10 (all versions including 1607, 1809, 21H2, 22H2) and Windows 11 (all versions including 23H2, 24H2, 25H2, 26H1) across 32-bit, x64, and ARM64 architectures. Windows Server administrators managing Server 2016, 2019, 2022, and 2025 editions. Any organization with domain-joined or standalone Windows systems is affected.
How it could be exploited
An attacker with a local user account logs into a Windows system and triggers an out-of-bounds read in the NTFS driver by accessing specially crafted files or file metadata. The attacker can then read information from adjacent memory that is not properly isolated.
Prerequisites
  • Valid local user account on the Windows system
  • Local interactive or remote desktop access to the system
Low exploit complexityRequires valid local accountInformation disclosure only (no code execution or denial of service)Low EPSS score (0.3%)
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXApply Microsoft's August 2026 security update to your Windows systems
View full vendor advisory
API: /api/v1/advisories/07b4c8ce-b859-480c-ba6b-e68772e72e76

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Windows NTFS Information Disclosure Vulnerability | CVSS 5.5 - OTPulse