The Windows Portable Device MTP Driver contains a heap-based buffer overflow that an unauthorized attacker can exploit with a physical attack to elevate privileges. By sending a crafted request to the driver from a malicious USB device, the overflow can be triggered, allowing execution of code at a higher privilege level within the kernel. The flaw is identified as CWE-122.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1, and all Windows Server releases from 2012 through 2025, including Server Core installations.

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires physical access to a device capable of communicating with the MTP driver, which limits the attack surface to environments where attackers can provide a malicious USB payload. Once the overflow is triggered, the attacker achieves elevated privileges, potentially gaining administrative control over the affected system.