An out-of-bounds read vulnerability in the Windows NTFS file system was read beyond the bounds of a data buffer, which can be leveraged to execute arbitrary code locally on the target machine. The weakness corresponds to CWE-125 (Out-of-Bounds Read) and CWE-191 (Integer Underflow). If successfully exploited, an attacker could gain the privileges of the account under which the file system service is running, potentially leading to full system compromise.

The issue affects multiple Microsoft Windows releases. Microsoft Windows 10 is impacted from version 1607 through 22H2 across both x86 and x64 architectures. Windows 11 versions 24H2, 25H2, and 26H1 on ARM64 and x64 are also vulnerable. Server versions from Windows Server 2012, including core installations, up to Windows Server 2025 NTFS component across all listed builds and does not appear to be limited to a specific edition or language pack.

The vulnerability has a CVSS score of 7.8, indicating a high severity but not critical. The EPSS score is reported as less than 1%, showing a very low but non‑zero likelihood of exploitation in the near term, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is local; an attacker must already have access to the affected machine or have the ability to run a malicious file within its context. Once the out-of-bounds read is triggered, escalation to arbitrary code execution can occur if the attacker can supply crafted NTFS structures.