This vulnerability is a heap‑based buffer overflow in the Windows NTFS file system that permits an authorized attacker to gain higher privileges over a network connection. By overflowing a buffer, the attacker can execute arbitrary code with the privileges of the affected user, potentially leading to full system compromise. The weakness is represented by CWE‑122 and CWE‑125, indicating buffer overflow and out‑of‑bounds read conditions.

Affected Microsoft products include Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), and Windows Server from 2012 to 2025 (including standard and server‑core installations).

The CVSS score of 7.1 classifies the flaw as a high‑severity vulnerability. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the possibility of exploitation remains for attackers who already have authorized network access to the affected systems. The lack of a publicly documented exploit suggests that the attack is complex but feasible for well‑equipped adversaries. Therefore, organizations should consider the risk as moderate to high, depending on the exposure level of the affected hosts.