CVE-2026-100223 Windows NTFS Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape.
Why am I seeing this Ranked on source trust — Microsoft
It ranks mainly on source trust: Microsoft is the most reliable outlet we track on this subject, and is the only one on the story so far.
It clears the bar without leading strongly on any one factor. A middling score is not a claim that the story is important — only that nothing about it is weak.
StandardStandard, because a first-party source is on it, the subject was identified from the text, and it scores 0.49 against a bar of 0.50.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 28% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 1.00 | +0.250 51% | Microsoft is the highest-trust source on this story and is first-party — the organisation announcing its own news. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.50 | +0.101 21% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
Windows NTFS contains an elevation of privilege vulnerability tied to how reparse points are handled by sandboxed processes. An attacker with local access can exploit this by running a specially crafted application that creates reparse points, allowing escape from the sandbox and privilege escalation on the affected system. Exploitation has not been confirmed in the wild.
The vulnerability requires an attacker to first obtain local logon access to the target system. Once logged in, they execute a malicious application designed to manipulate reparse point creation. This bypasses sandbox restrictions and grants the attacker elevated privileges over the compromised machine.
Microsoft addressed the issue through a security update that blocks sandboxed processes from creating reparse points that target files they cannot access. Organizations should apply this patch to systems running affected Windows NTFS implementations.
What happened
An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. To exploit the vulnerability, an attacker would first have to log on to the system, and then run a specially crafted application to take control over the affected system. The security update addresses the vulnerability by preventing sandboxed processes from creating reparse points targeting inaccessible files.
Limited impact or meaningful preconditions.
- Impact
- Privilege Escalation
- Product
- Windows NTFS
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Microsoftfirst-party first seen CVE-2026-100223 Windows NTFS Elevation of Privilege Vulnerability
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.