A heap‑based buffer overflow exists in the Windows NTFS file system component. The flaw allows an unauthorized attacker to corrupt memory while performing certain file system operations, enabling the execution of code under the local user’s credentials. The vulnerability is a classic memory corruption issue (CWE‑122).

Affected are Microsoft Windows 10 (v16 070, 18 090, 21 H2, 22 H2), Windows 11 (v24 H2, 25 H2, 26 H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations. The vulnerability is present on x86, x64, and arm64 platforms where the operating system is deployed, as indicated by the published CPE data.

The CVSS score of 7.8 classifies this flaw as high severity, while an EPSS score of less than 1 % indicates a very low exploitation likelihood. The lack of listing in CISA’s KEV catalog and absence of documented public exploits further reduce the immediate threat. Exploitation requires local access to trigger an NTFS operation that causes the overflow; upon exploitation, the attacker can run code with the privileges of the user initiating the operation but no additional elevation is described.