Windows NTFS contains a use‑after‑free flaw that enables an authorized local user to elevate privileges on the affected system. The bug occurs when NTFS mishandles a freed memory object, allowing the attacker to execute privileged operations with the rights of a higher‑privileged account. This is a classic ownership vulnerability classified as CWE‑416.

The vulnerability impacts many Microsoft Windows builds including Windows 10 V1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 R2 up to Windows Server 2025. The affected binaries are listed under the corresponding CPE names for 32‑bit, 64‑bit, and ARM64 variants. If an organization deploys any of these versions, the flaw is present unless mitigated by an update.

The CVSS score of 7.8 indicates high severity, and the lack of an EPSS score means we cannot estimate the current exploitation probability. The vulnerability is not in CISA’s KEV catalog, and the attack requires local, authorized access; remote exploitation is not supported. Therefore, the risk is significant for systems that run these Windows versions with normal user privileges who could become local attackers through phishing or other compromise methods.