This vulnerability exposes the Windows NTLM protocol to external manipulation of file name or path parameters, allowing an attacker to masquerade as another local account or service. The flaw is a form of improper input validation, classified as CWE‑73. A successful exploitation could enable an attacker to impersonate system users or services, potentially gaining unauthorized access to resources or executing commands with the impersonated account’s privileges, but the description does not confirm full remote code execution.

Microsoft Windows 10 operating systems from version 1607 through 22H2, Windows 11 operating systems from 23H2 onwards, and Microsoft Windows Server editions including 2012 R2, 2016, 2019, 2022 and the forthcoming 2025. All 32‑bit and 64‑bit builds for these release lines are affected.

The CVSS score of 3.3 indicates a low risk. The EPSS score of less than 1% shows an extremely low likelihood of exploitation currently observed. The vulnerability has not been listed in the CISA KEV catalog, suggesting no known or widely exploited attacks. The likely attack vector is local or within a network where NTLM authentication is used; no remote exploitation pathway is described.