An out‑of‑bounds read vulnerability in Windows Extensible File Allocation allows an authorized user on a system to elevate local privileges. This weakness permits an attacker to read beyond intended memory boundaries, enabling escalation to a higher privilege level. The vulnerability, identified as CWE‑125, can be leveraged to gain administrative rights on the compromised machine, compromising confidentiality, integrity, and availability of the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including all Server Core installations. All 32‑bit and 64‑bit builds of these operating systems are affected.

The CVSS v3.1 score is 7.8, indicating high severity, but the EPSS score is below 1%, suggesting a low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access, making it a local privilege escalation vector. Once an attacker gains elevated rights, they can alter system settings, install malware, or compromise other network assets. Organizations that have not applied the patch should monitor the vulnerability and prioritize remediation to reduce the potential impact.