A heap-based buffer overflow in the Windows NTFS file system component allows an attacker who already has authorized local access to execute arbitrary code. The flaw occurs when invalid NTFS metadata is processed, causing a memory overwrite that can be leveraged to run code with the privileges of the affected process.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and Microsoft Windows Server releases 2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022 (including 23H2 edition), and 2025 (including Server Core installations).

The vulnerability is considered high severity, yet the probability of exploitation is assessed to be very low, and it is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to be an authorized local user who can create or alter NTFS metadata that the operating system subsequently processes. If successful, the attacker can execute code with elevated or SYSTEM-level privileges, potentially compromising the confidentiality, integrity, and availability of the system.