CVE-2026-20922CWE-122

CVE-2026-20922

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
64.9
In the wild
Unconfirmed
What it is

⚡ A heap-based buffer overflow lurking in Windows NTFS could let an authorized attacker execute code locally, and it’s absolutely mind-blowing how simple it could be! Think of it like a sneaky chef who knows where to find the hidden ingredients in a locked pantry — they can whip up a dangerous dish without anyone noticing. In this case, the pantry is your Windows NTFS, and the chef is the attacker! This vulnerability could allow an attacker to run arbitrary code on the affected system, possibly gaining full control. Imagine them walking right into your digital kitchen, adjusting settings, harvesting sensitive data, or even planting malicious software! That's a severe security risk.

Put simply

Think of it like a sneaky chef who knows where to find the hidden ingredients in a locked pantry — they can whip up a dangerous dish without anyone noticing. In this case, the pantry is your Windows NTFS, and the chef is the attacker! The vulnerability arises due to improper memory handling in Windows NTFS, which can lead to a buffer overflow when an authorized user exploits it. This allows that user to execute arbitrary code in the context of the system, posing a significant risk.

What to do

This vulnerability could allow an attacker to run arbitrary code on the affected system, possibly gaining full control. Imagine them walking right into your digital kitchen, adjusting settings, harvesting sensitive data, or even planting malicious software! That's a severe security risk. To address this vulnerability, update your Windows systems immediately to the latest patch provided by Microsoft. Ensure that all users are operating with the least privilege necessary, and consider implementing additional monitoring for suspicious activities. You've got this! By taking these steps, you're on your way to locking down your systems tighter than a vault! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01084 · 64.9th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2026-01-13T23:16Z
Affected products (19)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows NTFS Remote Code Execution Vulnerability
    cvelistv5