The vulnerability is an out‑of‑bounds write located in the NTFS file‑system driver. An authenticated Windows user can exploit this defect to execute arbitrary code with the privileges of the calling process. The flaw is classified as a buffer overflow (CWE‑787) that could lead to privilege escalation on the affected host.

Affected products include Windows 10 versions 1809, 21H2, 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1, and Windows Server 2019, 2022 and 2025, in both normal and Server Core installations.

The CVSS base score is 7.8, indicating a high severity. The EPSS score is unavailable and the vulnerability has not yet been listed in the CISA KEV catalog. Because the weakness requires local authority, an attacker would need legitimate access to the machine or to a privileged account. With the service provider’s update available, the risk can be mitigated by patching the affected Windows releases. Until that patch is applied, sites with elevated privileges should monitor for unexpected write or execution activities.