---
id: "CVE-2026-102200"
page: "https://infrastack.ai/live/CVE-2026-102200"
kind: "vulnerability"
aliases: ["CVE-2026-102200"]
title: "Windows NTFS: race condition lets a local user tamper with files"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "ntfs", "windows"]
not_affected_if: ["single-user-trusted-machines"]
published_at: "2026-11-10T19:17:39+00:00"
first_seen_at: "2026-11-10T19:24:13+00:00"
updated_at: "2026-11-10T20:04:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102200", "first_seen_at": "2026-11-10T19:24:13+00:00"}]
exploit_sources: []
---

# Windows NTFS: race condition lets a local user tamper with files

Link for people: https://infrastack.ai/live/CVE-2026-102200 (this .md is for agents)

A time-of-check to time-of-use race in the Windows NTFS file system lets an attacker who already has an account on the machine change data they should not be able to alter. The flaw is only triggered locally, so an attacker must first be logged in or running code on the system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102200

## From the sources

Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an authorized attacker to perform tampering locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_