A heap‑based buffer overflow flaw in the Windows Volume Manager Extension Driver can be leveraged by an unauthenticated attacker to execute arbitrary code with SYSTEM privileges. The flaw is a classic out‑of‑bounds write (CWE‑122). If triggered, the attacker gains full control of the affected machine, enabling persistence, data exfiltration, or further lateral movement. The vulnerability can be triggered over the network, so no local privileges are required to exploit it.

Systems affected by this flaw include a wide range of Microsoft Windows releases. Desktop clients running Windows 10 from the 1607 to 22H2 releases, as well as Windows 11 from the 23H2 through 26H2 releases, are impacted. Server editions from Windows Server 2012 up through Windows Server 2025, including core installations, also contain the vulnerable driver. The driver is present on both x86, x64, and ARM64 architectures as specified by the affected CPEs.

The assessment assigns a CVSS score of 9.8, indicating very high severity. No EPSS score is publicly available, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can reach the vulnerable driver through network traffic, making exploitation feasible in exposed environments. Because the flaw allows code execution without authentication, the risk is especially high for machines that are remotely reachable. There is no known public exploit, but the high CVSS indicates the vendor has judged the risk to be substantial.