The vulnerability is a heap‑based buffer overflow within the Windows NTFS file system driver. An authorized local attacker can craft a specially formatted NTFS metadata structure that overflows a boundary and causes the system to execute code with the privileges of the user performing the action. This allows arbitrary code execution on the host, potentially enabling full system compromise if the attacker already holds privileged accounts.

Affected versions include Microsoft Windows 10 build 1607 through 22H2, Windows 11 variants 22H3, 23H2, 24H2 and 25H2, and Windows Server editions from 2008 R2 SP1 to 2025. The flaw applies to both standard and Server Core installations, as identified by the listed CPE strings.

The CVSS score of 7.8 marks the flaw as high severity. EPSS indicates a very low probability (<1%), and the vulnerability is not cataloged in CISA’s KEV. The attack vector requires local access to create or modify NTFS metadata; the data are not exposed over the network, so remote exploitation is not currently feasible. Because the flaw is in a kernel‑mode component, successful exploitation would run code with kernel privileges. Organizations should treat this as a local privilege escalation risk and prioritize the patch.