A heap‑based buffer overflow in the Windows Encrypting File System (EFS) can be triggered by a local user with authorized access to the system. The overflow allows the attacker to gain elevated privileges on the affected machine, potentially providing full control over the operating system and all its data. This flaw is a classic example of CWE‑122, where an incorrect memory copy without bounds checking grants the adversary the ability to overwrite critical data structures and execute arbitrary code.

Microsoft Windows 10, versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11, versions 23H2, 24H2, 25H2, 26H2 and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including both standard and Server Core installations.

The CVSS base score is 7, indicating a high severity vulnerability with a local impact. The EPSS score is not provided, so the current exploitation probability is unknown, but the lack of a KEV listing suggests no widespread exploitation has been observed yet. Nevertheless, because the flaw requires only local privileged or normal user access, it remains a high‑risk target for attackers who have physical or administrative access to the system.