The vulnerability involves an externally controlled format string in Windows NTFS, which allows an authorized local attacker to elevate privileges on the target system. The flaw is a result of improper format string handling (CWE‑134). The attack can be used to run operations at a higher privilege level that the attacker would normally not have.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022 and 2025, including their Server Core installations.

The CVSS base score of 7.8 indicates a moderate to high risk. EPSS data is not available, so the likelihood of exploitation is not quantified. The vulnerability is not listed in CISA’s KEV database. Attack vector is local, as the flaw requires an authorized user to create a specially crafted NTFS entry. Successful exploitation would elevate the attacker’s privileges, allowing the execution of higher‑privilege actions on the system.