The vulnerability is an external control of the file name or path used during Windows NTLM authentication. By manipulating this value, an attacker can spoof network communications and masquerade as a legitimate system or user, potentially leading to unauthorized access or data manipulation. The flaw is mapped to CWE‑73, reflecting the risk of path traversal or unauthorized file access.

Microsoft Windows operating systems are impacted, including Windows 10 builds 1607 through 22H2, Windows 11 builds 23H2 through 25H2, and a range of Windows Server editions spanning Server 2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both 32‑bit and 64‑bit versions, as well as Server Core installations, are affected as listed in the CNA vendor data.

The CVSS base score of 6.5 indicates moderate impact while the EPSS score of less than 1 % indicates a very low probability of exploitation at this time. The vulnerability is not currently listed in the CISA KEV catalogue. An attacker suitable for exploiting this flaw would need network access to a target that uses NTLM authentication and the ability to supply or manipulate a file path during that process—most commonly over SMB or remote desktop traffic. No elevated privileges on the target machine are required beyond those normally granted to users engaging in NTLM authentication.