Microsoft Windows NTFS: Elevation of privilege via integer overflow

Summary

Microsoft Windows NTFS, the file system component of Windows, contains an integer overflow or wraparound (CWE-190) that allows an authorized local user to gain higher privileges on the affected system. The attacker needs local access and a low-privileged account, and no user interaction is required. The vulnerability is not directly internet-exposed, but it makes other compromises, such as a phished user account, more severe.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 and 2012 R2, including Server Core installations (6.2.9200.0 to below 6.2.9200.26434; 6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later
• Windows 10 Version 1809: build 10.0.17763.9376 or later
• Windows 10 Version 21H2 and 22H2: build 10.0.19044.7807 or 10.0.19045.7807 or later
• Windows 11 Version 23H2: build 10.0.22631.7652 or later
• Windows 11 Version 24H2, 25H2 and 26H2: build 9711 in the respective branch or later
• Windows 11 Version 26H1: build 10.0.28000.3231 or later
• Windows Server 2012 and 2012 R2: see MSRC page for the security update
• The KB article numbers are listed on the MSRC page. Unknown in this summary.

Workaround

Unknown. No vendor workaround is documented; patching is the only confirmed remedy.

Exploitation

• Publicly disclosed: No
• Exploited in the wild: No
• Microsoft exploitability assessment: Exploitation Less Likely; exploit code maturity: Unproven
• No public proof of concept or in-the-wild exploitation found at the time of research

Our recommendation

• Identify Windows 10 1607 and Server 2016 hosts and compare their build with 10.0.14393.9612.
• Install the October 2026 security updates on all affected systems.
• Verify the support status of Windows 10 1607 on Microsoft's lifecycle page; if the branch is out of support, plan an upgrade.
• Prioritise shared workstations, terminal servers and file servers with many local users.
• Restrict local logon on multi-user systems and review local administrator rights.
• Recheck the MSRC page and exploit sources for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC advisory CVE-2026-69916 msrc.microsoft.com
• NVD record via Vulners vulners.com
• CNA CVE record via Vulners vulners.com
• Microsoft customer-risk document 2026 CVEs cdn-dynmedia-1.microsoft.com
• OpenCVE CVE-2026-69916 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:45.