Description

Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-11T17:18:09.620Z",
  "pubdate": "2026-08-11T17:18:09.620Z",
  "executiveSummary": "This vulnerability is classified as a buffer over-read within the Windows NTFS file system implementation. The primary security impact is unauthorized information disclosure, allowing an attacker to read sensitive memory contents from the underlying system. The affected product is the Windows NTFS component. The risk implication centers on the potential exposure of confidential data stored in kernel memory, which could facilitate subsequent exploitation phases or expose cryptographic material and system credentials. The attacker capability required for this vector involves executing a physical attack against the target machine. Based on the provided threat parameters, exploitation requires physical access to the system hosting the vulnerable file system, obviating the need for remote network connectivity or prior authentication, but mandating direct interaction with the hardware or storage media.",
  "technicalDetails": "The root cause of the vulnerability stems from improper bounds checking within the Windows NTFS driver when processing specific data structures from storage media. Specifically, the parsing logic fails to validate the size parameters of input buffers against the actual allocation boundaries, resulting in a buffer over-read condition. The vulnerable component resides within the kernel-mode NTFS file system driver responsible for interpreting volume structures and metadata. Exploitation occurs when an unauthorized attacker leverages physical access to manipulate or present a specially crafted storage medium or execute direct hardware-level interactions that trigger the parsing of malformed NTFS structures. As the driver processes the oversized or improperly bounded data fields, it reads past the legitimate end of the allocated buffer into adjacent kernel memory spaces. This payload behavior allows the contents of adjacent kernel pool or stack memory to be inadvertently captured and subsequently exposed through system responses or logging mechanisms. The attack flow begins with the physical provisioning or attachment of the malicious storage media to the victim machine. Upon mounting or accessing the file system, the operating system kernel invokes the vulnerable NTFS parsing routines. The lack of rigorous input validation causes the out-of-bounds read operation to execute in ring 0 context. Because the execution occurs with kernel privileges, the over-read can access sensitive kernel memory structures. Post-exploitation impact is strictly localized to information disclosure, wherein the attacker harvests leaked memory contents to map kernel layouts, bypass security controls, or extract sensitive data residing in volatile memory. Authentication requirements are nonexistent as the attack bypasses logical access controls via physical vectors, and network exposure is entirely absent since the vulnerability is locally triggered through physical means."
}