An untrusted pointer dereference in the Windows NTFS file system driver allows an attacker with authorized local access to corrupt kernel data structures, resulting in elevation of privileges to system level. The flaw is classified as CWE‑822 and leads to a hardening failure where untrusted data is used to influence privileged operations. As a result, compromised local users could move from standard user to full administrative access, risking confidentiality, integrity, and availability of the affected machine.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) on x86, x64, and arm64 architectures, as well as Windows Server 2012 through 2025 (including core installations) on x64 platforms are impacted. The issue also affects Windows Server 2012 and 2012 R2, 2016, 2019, 2022, and 2025 (both full and core editions).

The CVSS score of 7.8 indicates medium‑high severity, the EPSS score is not available, and the vulnerability is not catalogued in CISA KEV. The attack vector is inferred to be local, requiring an attacker who already has some level of access on the target system. Once exploited, the attacker can gain root or SYSTEM privileges, and no network exposure is required, increasing the risk for compromised devices in enterprise environments.