The vulnerability is an external control of the file name or path used during Windows NTLM authentication. By manipulating this value, an attacker can spoof network communications and masquerade as a legitimate system or user, potentially allowing unauthorized access or data modification. The flaw is mapped to CWE‑73, indicating path traversal or unauthorized file access risks.

Microsoft Windows 10 builds 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 builds 23H2, 24H2, 25H2, and 22H3; and Microsoft Windows Server editions 2008 R2 SP1, 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, and 2025 are all affected. Both 32‑bit and 64‑bit configurations, including Server Core installations, are part of the impact set as identified by the CNA vendor data.

The CVSS base score of 6.5 indicates moderate severity, while the EPSS score of 19 % suggests a moderate likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need only network access to systems that use NTLM authentication and the ability to supply or alter a file path during that process—commonly over network services that rely on NTLM, such as SMB or remote desktop. No elevated privileges on the target machine are required beyond those normally granted to users engaging in NTLM authentication.