Untrusted pointer dereference in the Windows NTFS file system allows a user with authorized local privileges to execute arbitrary code on the affected system. This flaw, categorized as CWE‑822, can be leveraged by an attacker who already has some level of access to perform malicious actions or elevate privileges further, potentially compromising system confidentiality, integrity, and availability.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 editions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. Both x86 and x64 architectures are impacted, with additional ARM64 susceptibility in Windows 11 26H2. These include both server core and full client installations.

The CVSS score of 6.7 indicates a moderate severity, while the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The flaw requires an attacker to be authorized with sufficient privileges to write to the NTFS volumes; it is not remotely exploitable over the network. Thus, the exploitable attack vector is local, contingent on having high-level user or system‑service access to the affected file systems.