A stack-based buffer overflow exists in the Windows NTFS file system that enables a local attacker with authorized access to overwrite stack memory when handling certain NTFS structures. The flaw can be manipulated to execute arbitrary code and elevate privileges, allowing the attacker to gain higher rights on the host. The weakness corresponds to CWE‑121.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 24H2, 25H2 and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including server core configurations. All listed releases are vulnerable unless a cumulative update that fixes the issue has already been applied.

The CVSS score is 7.3, indicating high severity, while the EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local; an attacker must have authorized user rights to trigger the overflow via crafted inputs to NTFS. No remote exploitation path is indicated in the available information.