The vulnerability is a heap‑based buffer overflow in the Windows exFAT file system driver. An attacker with local access can supply malicious data that overflows a heap buffer, enabling execution of arbitrary code with elevated privileges. This flaw permits a local user to gain higher trust levels, potentially compromising system integrity and confidentiality.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012 through 2025, including core installations and ARM64 variants. All listed releases are affected.

The CVSS score of 7.8 indicates high severity, but the EPSS score is not available, so current exploitation likelihood is unknown. The vulnerability is not yet listed in CISA’s KEV catalog. Attackers would need local privileges and access to exFAT volumes to trigger the overflow. Because the flaw requires a malicious file on an exFAT file system, exploitation is limited to environments that use exFAT and where an attacker can write to that volume.