CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream
The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
Last updated
Overview
An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.
Background
Alternate data streams (ADS) were first implemented in the Windows NT operating system to provide compatibility between NTFS and the Macintosh Hierarchical File System (HFS). In HFS, data and resource forks are used to store information about a file. The data fork provides information about the contents of the file while the resource fork stores metadata such as file type.
Real-world CVEs
3 recorded CVEs are caused by CWE-69 (Improper Handling of Windows ::DATA Alternate Data Stream). The highest-severity and most recent are shown first. 1 new CWE-69 CVE has been recorded so far in 2026 (1 in 2025).
Common consequences
What can happen when CWE-69 is exploited.
Bypass Protection Mechanism, Hide Activities, Other
Affects: Access Control, Non-Repudiation, Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Operating systems
How to prevent it
Practical mitigations for CWE-69, grouped by where in the lifecycle they apply.
Ensure that the source code correctly parses the filename to read or write to the correct stream.
How to detect it
Automated Analysis
Software tools are capable of finding ADSs on your system.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-1999-0278 — In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.
- CVE-2000-0927 — Product does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions.
Terminology & mappings
Mapped taxonomies
- PLOVER: Windows ::DATA alternate data stream
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-69.
- What is CWE-69?
- The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
- What CVEs are caused by CWE-69?
- 3 recorded CVEs are attributed to CWE-69, including CVE-2025-3941, CVE-2024-43033, CVE-2026-52792.
- How do you prevent CWE-69?
- Ensure that the source code correctly parses the filename to read or write to the correct stream.
- How is CWE-69 detected?
- Automated Analysis: Software tools are capable of finding ADSs on your system.
- What are the consequences of CWE-69?
- Exploiting CWE-69 can lead to: Bypass Protection Mechanism, Hide Activities, Other.
- Is CWE-69 actively exploited?
- 3 recorded CVEs are caused by CWE-69; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-69) (opens in a new tab)
- CWE-69 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-69
Get alerted the moment a new CWE-69 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.