A heap‑based buffer overflow exists in the Windows NTFS file system component that can be triggered by an authorized user who can write data to a file on an NTFS volume. When the overflow occurs, the attacker can cause the operating system to execute arbitrary code with elevated privileges, effectively turning a standard user account into an administrator. This weakness is classified as CWE‑122 and enables a local privilege escalation that compromises the confidentiality, integrity, and availability of the affected system by allowing an attacker to gain full control of the machine.

The flaw affects several Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (repeated), 26H1; and the Windows Server line from 2016 through 2025, covering both standard and Server Core installations, as well as ARM‑64 and x86/x64 architectures.

The CVSS score of 7.8 indicates a high severity vulnerability, while the lack of a reported EPSS score suggests no current widespread exploitation but the potential remains significant. The vulnerability is not listed in the CISA KEV catalog, yet the local nature of the attack vector means that any user who can write to an NTFS volume could exploit it. Because attackers can target local accounts, the risk is high in environments where privileged accounts are distributed or where local admin rights are granted broadly.