The flaw originates from improper handling of special elements in the CLFS.sys file system driver, a CWE‑159 weakness that can lead an attacker to trigger the KeBugCheckEx routine. When an unprivileged user crafts a malicious input, the driver fails in a way that forces the kernel to issue a bug check, resulting in a non‑recoverable system crash. The consequence is a loss of service and potential data loss, and the flaw does not require elevated privileges.

Microsoft Windows users are affected, specifically those running Windows 11 1123h2 or earlier, and earlier builds of Windows 11 2024 LTSC and Windows Server 2025. Microsoft released a silent fix in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025, which also covered the Windows 25H2 release in September. Systems that have not applied that update remain vulnerable.

The CVSS score of 5.5 reflects a moderate impact with local attack potential. EPSS indicates a very low exploitation probability (< 1 %). The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. An attacker only needs local access and does not require any network privileges; the vulnerability is therefore most likely exploited through local user interaction or scripts that run with non‑elevated rights.