The vulnerability is an out-of-bounds read in the Windows NTFS file system that can be triggered by an attacker who already has local system access. The flaw is a classic buffer over-read (CWE‑125) that allows the attacker to gain the privileges of the process that performed the read, effectively raising local privileges. As a result, a user with limited rights could execute code with higher privileges on the same machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and their server core installations, including ARM64 builds of Windows 11 26H2.

The CVSS score of 7.8 rates the flaw as high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no current evidence of widespread exploitation. The likely attack vector is local execution; an attacker must already have authenticated local access, which may be achieved through phishing or credential compromise. Once triggered, the exploit can grant the attacker elevated privileges on the affected system, potentially enabling full system compromise.