CVE-2026-65784

The CVSS 5.5 score for this NTFS out-of-bounds read vulnerability is a red herring for defenders. The real risk isn't measured by that number — it's measured by where this vulnerability lives in your architecture and what it sits adjacent to. NTFS is not a peripheral driver. It sits beneath the access control model, and when an out-of-bounds read occurs in NTFS metadata handling, the kernel has mapped session tokens, DPAPI keys, and cached credential material into adjacent memory pages. Microsoft's advisory doesn't specify exactly which metadata structures expose this read, but the historical pattern is clear: CVE-2018-0965 (NTFS OOB read in fastfat, CVSS 6.8) and CVE-2019-1251 (NTFS journal callback manipulation) both surfaced in incident postmortems as the pivot that turned initial access into domain persistence. The adjacency that matters isn't random heap — it's the hot path for session reconstruction during Fast Boot and resume-from-hibernate, where Windows reconstructs credential state from structures that NTFS access routines routinely touch. For your triage: treat any NTFS out-of-bounds read as a credential extraction primitive until proven otherwise. The 'authorized attacker' qualifier in the CVE means you should assume this is a second-stage tool — attackers who already have local code execution use it to fish for tokens that persist across sessions. If your threat model includes actors with local access, this is a critical chaining component, not a medium information disclosure. Prioritization depends on your Windows version distribution. Windows 10 1607 reached end of servicing in 2019 — systems still running it have no remediation path, and the absence of patching means other controls have likely atrophied alongside it. For supported versions, the patch exists but the organizational exposure window matters more than the CVSS score suggests: medium-severity foundational-component CVEs don't trigger emergency patching cycles, creating the 18-36 month lag between patch and postmortem that the historical record documents. Monitor for this CVE in incident data, not just your vulnerability scanner — that's where it will surface next.

Reviewed through automated stages and approved by a human before publication.