A heap-based buffer overflow in the Windows NTFS file system allows an unauthorized local user to execute arbitrary code with the privileges of the affected process. This flaw can compromise the confidentiality, integrity, and availability of the machine by enabling a local attacker to run malicious code, modify system files, or elevate privileges.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Core installations, are all impacted by this vulnerability.

The CVSS score of 7.8 reflects a high-severity local exploitation risk, with no EPSS score available and the vulnerability not listed in CISA’s KEV catalog. The attack vector is inferred to be local, as the description indicates that an unauthorized attacker must be able to access the NTFS volume. Exploitation requires the attacker to craft a malicious file or perform a specific file operation that triggers the heap overflow. The weaknesses involve improper input validation (CWE-20) and heap-based memory corruption (CWE-122).