The vulnerability arises from external control of file name or path used within the Windows NTLM authentication protocol. When an attacker can influence this component, they can forge NTLM authentication exchanges, potentially exposing NTLM hash values or enabling impersonation of legitimate users. This flaw does not directly grant code execution but can compromise confidentiality and integrity of authentication credentials over a network.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3; Windows Server 2008 R2 SP1 (Base and Server Core), 2008 SP2, 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations).

The CVSS score of 6.5 indicates a moderate risk, while the EPSS score of less than 1% suggests a current low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve network-based encounters where an attacker initiates or interposes NTLM authentication exchanges, controlling the file name or path field to spoof the authentication sequence. No additional prerequisites are noted beyond network presence and ability to send crafted NTLM traffic.