The flaw is an integer overflow or wraparound in the Windows NTFS file system handling code. An authorized local user can exploit this to obtain higher privileges on the affected system. The core weakness corresponds to CWE-190, which allows an attacker to manipulate a numeric value beyond its intended limits, leading to unintended behavior and privilege escalation.

Microsoft products affected include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; as well as Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and Server Core installations. These systems run on x86, x64, and ARM64 architectures as listed in the provided CPE identifiers.

The vulnerability has a CVSS score of 7.8, indicating moderate to high severity. EPSS data is unavailable, so the current exploitation probability cannot be quantified. It is not listed in CISA KEV. Exploitation requires local access by an authenticated user; the attacker must have sufficient rights to interact with NTFS to trigger the overflow. Once triggered, local privilege escalation could allow the attacker to gain administrative or SYSTEM level access, compromising confidentiality, integrity, and availability of the compromised host.