The vulnerability is a heap‑based buffer overflow in the Windows NTFS file system that permits an attacker with local access to exploit a memory corruption flaw and execute arbitrary code with the privileges of the process accessing NTFS. Because the flaw resides in the kernel component that manages file metadata, successful exploitation results in local code execution, allowing the attacker to gain privileges, modify system files, or install malware. The weakness corresponds to CWE‑122, a classic heap‑buffer‑overflow vulnerability that can lead to arbitrary code execution if not properly validated.

Affected products are Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2 as well as Windows 11 versions 24H2, 25H2, and 26H1. The same flaw also affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Core installations). The issue is present on x86, x64, and arm64 architectures as enumerated by the listed CPE identifiers.

The CVSS score of 7.8 indicates a high‑severity local code execution vulnerability, yet the EPSS score of less than 1 % shows a very low likelihood of public exploitation at this time, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires local user access or an already compromised system; therefore the threat is confined to machines that can run arbitrary code without privileged checks. Nonetheless, if an attacker gains local control—through malicious files, phishing, or other means—the heap overflow can be leveraged to execute arbitrary code, enabling privilege escalation or persistent footholds.