CVE-2026-49184 is a Windows NTFS heap-based buffer overflow that can lead to remote code execution. Microsoft rates it High severity with a CVSS v3.1 base score of 8.4 and temporal score of 7.3. The vector is local attack only (AV:L), with low attack complexity, no privileges required, and no user interaction. Microsoft lists exploit code maturity as unproven and reports no public disclosure or known exploitation. For enterprise environments, the local-only vector lowers risk compared with network-reachable flaws, but successful exploitation could still result in full compromise of affected hosts.

Highlights:
- CVSS scores: Base 8.4 - Temporal 7.3
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Remote Code Execution with HIGH confidentiality, integrity, and availability impacts.
- Exploitation likelihood: Exploitation Less Likely; local vector, low attack complexity, no privileges required, and no user interaction.
- Severity for enterprise: High technical severity due to code execution impact, but lower exposure-driven risk than network-based RCE because the attack vector is LOCAL.
- Patch status: available

Affected systems:
- Windows 10 1607
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025