Windows NTFS: Privilege escalation through untrusted pointer dereference

Summary

An untrusted pointer dereference in the Windows NTFS file system driver allows a local attacker with a valid low-privilege account to elevate privileges, potentially to SYSTEM. The CVSS vector requires local access, low privileges and no user interaction, so the flaw is not directly reachable from the internet. The main risk is an attacker who already has a foothold, for example through phishing or a stolen user login, on shared PCs, terminal servers or file servers.

Affected

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434 and 6.3.9600.0 to before 6.3.9600.23470
• Source: CNA record; verify the version table on the MSRC page.

Fixed in

• Install the October 2026 security update for each branch (Windows 10 1607 / Server 2016: KB5126868, build 14393.9612).
• Windows 10 1809 / Server 2019: build 17763.9376 or later.
• Windows 10 21H2 / 22H2: build 19044.7807 / 19045.7807 or later.
• Windows 11 23H2: build 22631.7652 or later; 24H2 / 25H2 / 26H2: build 26100.9711 / 26200.9711 / 26300.9711 or later; 26H1: build 28000.3231 or later.
• Windows Server 2012 / 2012 R2: build 6.2.9200.26434 / 6.3.9600.23470 or later (requires ESU where applicable).

Workaround

Unknown. No documented mitigation was found; patching is the only described remedy.

Exploitation

• No public exploit code known.
• Not known to be exploited in the wild; not checked directly against the CISA KEV catalogue.
• CISA SSVC: Exploitation none, Automatable no.
• EPSS is about 0.3 to 0.4 percent.

Our recommendation

• Inventory all Windows hosts with build numbers and identify Windows 10 1607, Server 2016 and any systems that depend on ESU.
• Deploy the October 2026 cumulative update to all affected systems; test first on systems running Exchange, as a separate Exchange issue is reported for KB5126868.
• For 1607/2016 systems that cannot be patched or are out of support, plan replacement or ESU enrolment and restrict local logons.
• Limit local logons on shared PCs, terminal servers and file servers, and monitor for privilege escalation to SYSTEM.
• Recheck the MSRC advisory and CISA KEV periodically.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-70172 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• Microsoft Update Catalog: KB5126868 www.catalog.update.microsoft.com
• NVD record via Vulners vulners.com
• CNA record via Vulners vulners.com
• OpenCVE: CVE-2026-70172 app.opencve.io
• VulDB: CVE-2026-70172 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 04:02.