The vulnerability is a heap‑based buffer overflow in the NTFS file system driver. An attacker who already has local access can exploit the overflow to hijack control flow and execute code with the privileges of the local user, thereby escalating to administrative level. The flaw is classified as CWE‑122 and CWE‑190.

It affects Microsoft Windows operating systems, specifically Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including their Server Core installations. All editions that include the NTFS file system in the listed releases are susceptible.

The CVSS score is 7.8, indicating serious severity. Because the EPSS score is not available, the current exploitation probability is unknown, yet the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local, authorised attacker, meaning the exploit requires physical or remote login privileges. Attackers can combine this flaw with other local elevation techniques to gain full administrator control, potentially allowing system compromise or denial of service.