A heap-based buffer overflow exists in the Windows exFAT file system driver. This flaw can be triggered by an authorized user to overwrite memory on the stack, leading to elevated local privileges. As a result, an attacker could execute code with higher rights, potentially compromising system integrity and confidentiality.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, including both standard and core installations. The vulnerability also appears in ARM64 builds of Windows 11 and selected 10/11 releases.

The CVSS score of 7.8 classifies the flaw as high severity, while the lack of an EPSS score means exploitation likelihood is not quantified. Microsoft does not list the vulnerability in CISA KEV. The likely attack vector requires local access by an authorized user; the attacker would need to manipulate exFAT input to trigger the overflow. Once exploited, privilege escalation can be achieved on the affected system without needing additional credentials.