A heap-based buffer overflow in the Windows NTFS file system driver allows an unauthorized attacker to execute code locally. The vulnerability may enable execution of arbitrary code on the affected system, but the specific downstream impacts are not detailed in the description.

Affected products include Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (builds 24H2, 25H2, 26H1), and the Windows Server family (2012, 2012 R2, 2016, 2019, 2022, 2025) in both standard and Server Core installations. All of these operating systems run the NTFS file system and are susceptible to the heap overflow described.

The CVSS score of 7.8 indicates a high severity. The EPSS score is below 1%, implying a very low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access and is triggered by a local NTFS operation; no remote trigger is noted.