CVE-2026-62887 - Windows NTFS Information Disclosure Vulnerability

Back Back to CVE browser

MEDIUM

Windows NTFS Information Disclosure Vulnerability

Published Aug 11, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

Affected products

Vendor Microsoft Product Windows 10 Version 1607 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9418
Vendor Microsoft Product Windows 10 Version 1809 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.9121
Vendor Microsoft Product Windows 10 Version 21H2 Default
unknown
Affected
- ≥ 10.0.19044.0, < 10.0.19044.7663
Vendor Microsoft Product Windows 10 Version 22H2 Default
unknown
Affected
- ≥ 10.0.19045.0, < 10.0.19045.7663
Vendor Microsoft Product Windows 11 Version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7517
Vendor Microsoft Product Windows 11 Version 24H2 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.9168
Vendor Microsoft Product Windows 11 Version 25H2 Default
unknown
Affected
- ≥ 10.0.26200.0, < 10.0.26200.9168
Vendor Microsoft Product Windows 11 version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.7517
Vendor Microsoft Product Windows 11 version 26H1 Default
unknown
Affected
- ≥ 10.0.28000.0, < 10.0.28000.2704
Vendor Microsoft Product Windows Server 2012 Default
unknown
Affected
- ≥ 6.2.9200.0, < 6.2.9200.26280
Vendor Microsoft Product Windows Server 2012 (Server Core installation) Default
unknown
Affected
- ≥ 6.2.9200.0, < 6.2.9200.26280
Vendor Microsoft Product Windows Server 2012 R2 Default
unknown
Affected
- ≥ 6.3.9600.0, < 6.3.9600.23338
Vendor Microsoft Product Windows Server 2012 R2 (Server Core installation) Default
unknown
Affected
- ≥ 6.3.9600.0, < 6.3.9600.23338
Vendor Microsoft Product Windows Server 2016 Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9418
Vendor Microsoft Product Windows Server 2016 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.14393.0, < 10.0.14393.9418
Vendor Microsoft Product Windows Server 2019 Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.9121
Vendor Microsoft Product Windows Server 2019 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.17763.0, < 10.0.17763.9121
Vendor Microsoft Product Windows Server 2022 Default
unknown
Affected
- ≥ 10.0.20348.0, < 10.0.20348.5499
Vendor Microsoft Product Windows Server 2025 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.33296
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.33296

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 1607	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9418
Microsoft	Windows 10 Version 1809	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.9121
Microsoft	Windows 10 Version 21H2	unknown	Affected ≥ 10.0.19044.0, < 10.0.19044.7663
Microsoft	Windows 10 Version 22H2	unknown	Affected ≥ 10.0.19045.0, < 10.0.19045.7663
Microsoft	Windows 11 Version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7517
Microsoft	Windows 11 Version 24H2	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.9168
Microsoft	Windows 11 Version 25H2	unknown	Affected ≥ 10.0.26200.0, < 10.0.26200.9168
Microsoft	Windows 11 version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.7517
Microsoft	Windows 11 version 26H1	unknown	Affected ≥ 10.0.28000.0, < 10.0.28000.2704
Microsoft	Windows Server 2012	unknown	Affected ≥ 6.2.9200.0, < 6.2.9200.26280
Microsoft	Windows Server 2012 (Server Core installation)	unknown	Affected ≥ 6.2.9200.0, < 6.2.9200.26280
Microsoft	Windows Server 2012 R2	unknown	Affected ≥ 6.3.9600.0, < 6.3.9600.23338
Microsoft	Windows Server 2012 R2 (Server Core installation)	unknown	Affected ≥ 6.3.9600.0, < 6.3.9600.23338
Microsoft	Windows Server 2016	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9418
Microsoft	Windows Server 2016 (Server Core installation)	unknown	Affected ≥ 10.0.14393.0, < 10.0.14393.9418
Microsoft	Windows Server 2019	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.9121
Microsoft	Windows Server 2019 (Server Core installation)	unknown	Affected ≥ 10.0.17763.0, < 10.0.17763.9121
Microsoft	Windows Server 2022	unknown	Affected ≥ 10.0.20348.0, < 10.0.20348.5499
Microsoft	Windows Server 2025	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.33296
Microsoft	Windows Server 2025 (Server Core installation)	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.33296

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56686
Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62887
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56686		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62887		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Aug 11, 2026

Updated Sep 29, 2026

Reserved Jul 14, 2026

Link CVE-2026-62887

CISA Vulnrichment

Updated Aug 11, 2026

NVD

Status Analyzed

Modified Aug 16, 2026

Link CVE-2026-62887

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Aug 11, 2026

Updated Sep 29, 2026

Link EUVD-2026-56686

GitHub

No data