A heap‑based buffer overflow occurs in the Windows NTFS file system component, allowing an attacker who has local, authorized access to execute arbitrary code on the machine. The overflow corrupts dynamic memory allocations and can be exploited to run code with the privileges of the interacting user, thereby providing full control over the affected system. This weakness is a classic example of CWE‑122, which means that software fails to properly manage heap memory bounds, leading to code execution vulnerabilities.

The vulnerability impacts multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and Server Core installations).

The CVSS score of 7.8 places this issue in the high severity range, and the exploitation probability score is not currently available, so the exact likelihood cannot be quantified. It is not listed in the CISA KEV catalog as of this analysis. The described attack requires a local, authenticated attacker with write permissions on the NTFS volume, indicating that exploitation is feasible only in environments where such access is available. Given the potentially severe local impact, the risk to affected systems remains significant until a vendor‑issued patch is applied.