Microsoft is planning to fix a Windows 10 vulnerability that could corrupt a NTFS-formatted hard drive simply by viewing a folder with a malicious shortcut
A bizarre Windows bug for 2021 — Microsoft says it's planning to fix a bizarre Windows 10 bug that could corrupt a hard drive just by looking at an icon.
Context & Ripple Effects
Microsoft is once again acknowledging a serious Windows flaw before shipping the fix: this time, merely viewing a folder containing a malicious shortcut can corrupt an NTFS-formatted hard drive, and the company says only that it is 'planning' a patch. That acknowledge-now, patch-later posture is well established in the related coverage — from the actively exploited font-rendering zero-day disclosed with no patch available, to the advisory for a wormable Windows 10 flaw that shipped with workarounds instead of a fix.
The gap between promise and patch has bitten before: researchers reported a critical RCE exploit in April and Microsoft rated it critical in May while it remained unpatched ([[a:979435]]), and a Windows 11 'unintended behavior' behind malware-like Bing pop-ups went unfixed for months after Microsoft said it would address it ([[a:843619]]). The NTFS bug matters because its trigger is passive — no click required — putting every Windows 10 user browsing shared or downloaded folders at risk until the patch lands.
First-order effects
- Windows 10 users and enterprises with NTFS file servers are exposed to data-corrupting drives simply by opening the wrong folder, with no patch available yet — only the promise of one.
Second-order effects
- Security teams fall back on interim mitigations and user warnings rather than patches, repeating the workaround-first playbook Microsoft used for the wormable-flaw advisory, while attackers treat shortcut and preview surfaces as cheap, high-impact targets.
Third-order effects
- If the disclose-then-delay pattern holds across the corpus — zero-days exploited without patches, critical RCEs left open for weeks — the effective window between public knowledge of a Windows flaw and remediation keeps widening, pressuring Microsoft's patch cadence and pushing enterprises toward isolation and backup strategies over timely patching alone.
The trend: Microsoft's vulnerability handling increasingly runs through public advisories that precede actual patches, stretching the exposure window for Windows flaws even as their triggers get simpler.