Windows NTFS Remote Code Execution Vulnerability

An attacker could send a specially crafted network request that exploits a buffer overflow in NTFS to run malicious code on a Windows computer or server with the same privileges as the system. This could allow unauthorized access to sensitive data, modification of files, or disruption of services running on that machine.

This affects Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems used as OT workstations, engineering stations, historian servers, or SCADA client machines. Any Windows-based computer or server in your plant network that processes NTFS data could be vulnerable if not patched.

An attacker sends a malicious network packet targeting the NTFS stack buffer overflow. The attack requires user interaction (the victim must open or access the malicious content), but once triggered, the attacker gains code execution on the target system. This could affect OT workstations, engineering stations, or servers involved in process control or data management.