A heap‑based buffer overflow in the NTLM authentication implementation allows an authorized local attacker to gain higher privileges on the affected Windows system. The vulnerability is a classic input validation error (CWE‑122) that can be triggered by sending crafted data during NTLM processing, resulting in the attacker executing code or modifying system state with elevated rights. This can compromise confidential data, alter system configuration, and impact availability if critical services are tampered with.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2016, 2016 (Server Core), 2019, 2019 (Server Core), 2022, and 2025, including all core installations. All listed operating systems are impacted.

The CVSS score is 7.8, indicating a high risk severity, and the vulnerability is not currently listed in the CISA KEV catalog. No EPSS data is available, so the likelihood of exploitation cannot be quantified, but the impact and the requirement of local authentication suggest that an insider or compromised local user could exploit the flaw. The attack vector is inferred to be local; a malicious user could trigger the overflow by sending malicious NTLM packets from an authorized account. Given the high severity and local scope, patching is the recommended response.