Microsoft has disclosed a heap-based buffer overflow in the Windows NTFS driver that allows an unauthenticated attacker to execute code over a network, rated CVSS 9.8 (Critical).
What Is It
CVE-2026-69463 is a heap-based buffer overflow in Windows NTFS. Per Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes the worst-case profile for a memory corruption bug: network-reachable, low attack complexity, no privileges, and no user interaction required, with total loss of confidentiality, integrity, and availability. The CVE was published on 2026-09-08 and is currently listed as "Awaiting Analysis" in NVD.
Why It Matters
NTFS is the default filesystem driver on every supported Windows release, and the driver runs in kernel context. A network-triggerable heap overflow in that code path means an attacker who can reach an affected system may be able to run code without any credentials or user action. The affected list spans client and server, desktop and Server Core, going back to Windows Server 2012; an unusually wide blast radius for a single defect.
No active exploitation has been confirmed in the source material reviewed here. That material does not include CISA Known Exploited Vulnerabilities catalog status either way, so defenders who need current KEV status should check the catalog directly rather than assume the CVE is absent from it.
What's Vulnerable
Microsoft lists the following as affected, each fixed at the build shown:
| Product | Fixed build |
|---|---|
| Windows 10 1607 / Server 2016 (incl. Server Core) | 10.0.14393.9512 |
| Windows 10 1809 / Server 2019 (incl. Server Core) | 10.0.17763.9245 |
| Windows 10 21H2 | 10.0.19044.7725 |
| Windows 10 22H2 | 10.0.19045.7725 |
| Windows 11 23H2 (x64, ARM64) | 10.0.22631.7582 |
| Windows 11 24H2 | 10.0.26100.* — revision unconfirmed, see below |
| Windows 11 25H2 | 10.0.26200.9445 |
| Windows 11 26H1 | 10.0.28000.2954 |
| Windows Server 2012 (incl. Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (incl. Server Core) | 6.3.9600.23397 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (incl. Server Core) | 10.0.26100.* — revision unconfirmed, see below |
Windows 11 24H2 and Windows Server 2025 both build on the 10.0.26100 lineage, but the underlying data carries two different revision numbers for them (.9445 and .33438). Those cannot both be the servicing revision for the same lineage, so at least one is wrong or reflects a different servicing branch. Rather than publish a threshold that may be incorrect, this table leaves the 26100 revision unstated: confirm the exact fixed build for 24H2 and Server 2025 against the MSRC entry before using it for patch compliance.
Platforms include 32-bit, x64, and ARM64 systems depending on the release.
Patch Status
Fixes are available. The source data specifies a fixed build for every affected product, so remediation is to update to at or above the listed build; subject to confirming the correct 26100-lineage revision noted above. The CVSS 9.8 rating and unauthenticated network vector warrant priority patching regardless of whether a federally mandated remediation deadline applies.
Sources
- Microsoft Security Response Center, CVE-2026-69463
- NIST National Vulnerability Database, CVE-2026-69463