A heap-based buffer overflow exists in the Windows NTFS file system component. The flaw can be triggered by an authorized local user and provides a path to execute arbitrary code or elevate privileges. Because the weakness lies in how memory is allocated for NTFS operations, an attacker can manipulate file metadata or perform malicious write operations to trigger a buffer overflow, leading to privilege escalation with the attacker’s account credentials. This is a classic heap overflow scenario (CWE-122) that can grant higher privileges on the local system.

The vulnerability affects various Microsoft Windows releases. Client Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. All affected versions are explicit in the vendor’s advisory.

The CVSS score of 7.8 indicates a high severity vulnerability. The exploitation path requires local authorization and privileges to operate inside the NTFS subsystem; remote exploitation is not possible as described. EPSS data is not available, so the current exploit probability is unknown, but the lack of KEV listing suggests no publicly known exploits at this time. Nevertheless, any authenticated user who can access the file system should be considered a threat vector, and the potential for privilege escalation warrants immediate attention.