The vulnerability is a heap‑based buffer overflow in the Windows NTFS file system driver. An unauthorized attacker can supply specially crafted input that overflows the internal buffer, enabling local code execution on affected systems.

Microsoft Windows 10 (versions 1607, 1809, 21H2, and 22H2), Microsoft Windows 11 (versions 24H2, 25H2, and 26H1), and Microsoft Windows Server editions from 2012 through 2025, including both full and Server Core installations. These releases run on x86, x64, and arm64 architectures as noted by the affected CPEs.

The CVSS base score of 7.8 indicates high severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation at this time. Based on the description, it is inferred that the vulnerability requires local access; an attacker must already be able to execute code or log in locally to trigger the overflow. It is not listed in the CISA KEV catalog.