The vulnerability numeric types within the Windows NTFS file system, which can be triggered by an authenticated local user. This flaw allows the attacker to gain higher privileges on the affected machine, potentially enabling malicious actions on the system.

Affected systems encompass Microsoft Windows 10 release versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 24H2, 25H2, and 26H1; and the Windows Server family—including 2012, 2012 R2, 2016, 2019, 2022, and 2025—both full desktop and server‑core installations.

The CVSS base score of 7.8 indicates high severity, while the EPSS score of less than 1% points to not listed in the CISA KEV catalog. An attacker must already possess local access and sufficient authorization to exploit the flaw, meaning that initial privileged rights are not required. Once exploited, the attacker can elevate privileges locally, potentially compromising system confidentiality, integrity, and availability.