{"id":"CVE-2026-102200","kind":"vulnerability","aliases":["CVE-2026-102200"],"related":[],"title":"Windows NTFS: race condition lets a local user tamper with files","description":"Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an authorized attacker to perform tampering locally.","summary":"A time-of-check to time-of-use race in the Windows NTFS file system lets an attacker who already has an account on the machine change data they should not be able to alter. The flaw is only triggered locally, so an attacker must first be logged in or running code on the system.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","ntfs","windows"],"not_affected_if":["single-user-trusted-machines"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:17:39+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","triaged_at":"2026-11-10T20:04:22+00:00","updated_at":"2026-11-10T20:04:22+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:04:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows NTFS: race condition lets a local user tamper with files","impact":"medium","summary":"A time-of-check to time-of-use race in the Windows NTFS file system lets an attacker who already has an account on the machine change data they should not be able to alter. The flaw is only triggered locally, so an attacker must first be logged in or running code on the system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","ntfs"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user modifies files they should not be able to change","analyst_note":"Find the affected Windows builds and the Microsoft fixed-build list for CVE-2026-102200 at the NVD link; sources give no version data.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-trusted-machines"],"who_is_affected":"Windows machines with NTFS volumes where untrusted or low-privileged users can log in or run code. The sources do not name affected Windows builds, so the team should check Microsoft's advisory for this CVE. Systems where only trusted administrators log in are at lower risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4504,"output_tokens":461,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102200':14A,17A '-2026':13A,16A 'abl':55B 'account':45B 'allow':92C 'alreadi':42B 'alter':57B 'attack':40B,66B,95C 'author':94C 'chang':49B 'check':25B,81C 'code':74B 'condit':4A,88C 'cve':12A,15A 'data':50B 'file':11A,36B 'first':68B 'flaw':59B 'infrastructur':18B 'let':5A,38B 'local':7A,63B,99C 'log':70B 'machin':48B 'must':67B 'ntfs':2A,19B,35B,91C 'perform':97C 'race':3A,31B,87C 'run':73B 'system':37B,77B 'tamper':9A,98C 'time':23B,28B,79C,83C 'time-of-check':22B,78C 'time-of-us':27B,82C 'toctou':86C 'trigger':62B 'use':30B,85C 'user':8A 'window':1A,20B,34B,90C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with NTFS volumes where untrusted or low-privileged users can log in or run code. The sources do not name affected Windows builds, so the team should check Microsoft's advisory for this CVE. Systems where only trusted administrators log in are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","ntfs","windows"],"campaign_type":null,"search_a":"'-102200':14A,17A '-2026':13A,16A 'condit':4A 'cve':12A,15A 'file':11A 'let':5A 'local':7A 'ntfs':2A 'race':3A 'tamper':9A 'user':8A 'window':1A","search_b":"'abl':55B 'account':45B 'alreadi':42B 'alter':57B 'attack':40B,66B 'chang':49B 'check':25B 'code':74B 'data':50B 'file':36B 'first':68B 'flaw':59B 'infrastructur':18B 'let':38B 'local':63B 'log':70B 'machin':48B 'must':67B 'ntfs':19B,35B 'race':31B 'run':73B 'system':37B,77B 'time':23B,28B 'time-of-check':22B 'time-of-us':27B 'trigger':62B 'use':30B 'window':20B,34B","search_c":"'allow':92C 'attack':95C 'author':94C 'check':81C 'condit':88C 'local':99C 'ntfs':91C 'perform':97C 'race':87C 'tamper':98C 'time':79C,83C 'time-of-check':78C 'time-of-us':82C 'toctou':86C 'use':85C 'window':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102200","severity":null,"published_at":"2026-11-10T19:17:39+00:00","modified_at":"2026-11-10T19:17:39+00:00","first_seen_at":"2026-11-10T19:24:13+00:00","fetched_at":"2026-11-10T19:24:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}