CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream
The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
Last updated
Overview
An attacker can use an ADS to hide information about a file (e.g. size, the name of the process) from a system or file browser tools such as Windows Explorer and 'dir' at the command line utility. Alternately, the attacker might be able to bypass intended access restrictions for the associated data fork.
Background
Alternate data streams (ADS) were first implemented in the Windows NT operating system to provide compatibility between NTFS and the Macintosh Hierarchical File System (HFS). In HFS, data and resource forks are used to store information about a file. The data fork provides information about the contents of the file while the resource fork stores metadata such as file type.
Real-world CVEs
2 recorded CVEs are caused by CWE-69 (Improper Handling of Windows ::DATA Alternate Data Stream). The highest-severity and most recent are shown first. 0 new CWE-69 CVEs have been recorded so far in 2026 (1 in 2025).