CVE-2026-62796

The CVSS 5.5 rating on this NTFS out-of-bounds read is creating dangerous false comfort. The 'authorized attacker' qualifier does significant obfuscation work that security teams need to interrogate directly. NTFS is not a userland application — it's the filesystem layer where Windows manages some of the most sensitive security structures in the operating system, including access tokens, handle tables, and credential cache artifacts. An out-of-bounds read here doesn't leak a filename; depending on what memory region the read straddles, it exposes token contents, kernel pool allocations, or security descriptor information that reveals privilege boundaries or enables construction of a more capable attack payload. The key question your assessment should answer: what memory region does this out-of-bounds read actually touch, and does that region contain Windows security-critical structures? If the answer is kernel pool memory or token-adjacent structures, the severity narrative needs revision upward regardless of what the CVSS vector says. The 'local information disclosure' description undersells the tactical implications. In a post-exploitation scenario — compromised endpoint, red team engagement, living-off-the-land attack — this class of vulnerability operates as a pivot point. It reads what it shouldn't, the attacker learns something they shouldn't know, and that knowledge enables the next stage. Windows credential architecture is built on the assumption that kernel memory regions containing credential artifacts are unreachable from userland. This vulnerability doesn't just break a bounds check; it breaks that architectural assumption. The 'authorized attacker' qualifier is also doing regulatory arbitrage work — it retrofits the vulnerability into a threat model where the NTFS driver developer was told to trust the caller, but a filesystem driver sitting between arbitrary user-controlled storage and kernel memory should trust nothing. The qualifier assumes a stable, intentional authorization boundary that doesn't exist in practice. Enterprise environments have service accounts with local user privileges compromised via phishing, credential stuffing, or supply chain attacks. Red teams already treat 'local user' as 'game over for credential harvesting' because the privilege separation between a standard user and the credential cache is thin. What to do: prioritize this patch in your queue regardless of the CVSS number. The exploitability may be low right now because no public exploit exists, not because the vulnerability is inherently hard to weaponize. History shows NTFS filesystem vulnerabilities frequently become reliable primitives in post-exploitation toolkits once disclosed. Your risk model should assume weaponization will occur and treat the EPSS 0.00332 as a lag indicator, not a true probability. Given the state-dependent nature of the vulnerability — weaponizability depends on what else is running on the system when exploitation occurs — the longer this remains unpatched, the more opportunities for favorable alignment with credential-caching system states.

Reviewed through automated stages and approved by a human before publication.