The vulnerability is an integer underflow (wrap or wraparound) in the Windows NTFS file system. It allows a local attacker who has authorized access to the machine to read data from NTFS metadata that should otherwise be inaccessible, compromising the confidentiality of the system. The weakness is identified as CWE‑191, a classic signed integer underflow flaw.

Affected systems include various editions of Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H2, 23H2, 26H1). All supported Windows Server releases from 2012 through 2025, both full and Core installations, are also impacted. The vulnerability does not affect newer Windows releases beyond those listed.

The CVSS score of 5.5 places the vulnerability in the medium range. No EPSS score is available, and the issue is not currently listed in CISA’s KEV catalog, suggesting no known large‑scale exploitation yet. Attacking requires local, authorized privileges and likely would be limited to users with administrative or similar rights, though the exact adversary model is inferred from the description of an “authorized attacker.”