This vulnerability involves a heap-based buffer overflow in the Windows NTFS file system driver on Windows 10 Version 1607 (build 10.0.14393.0). An attacker with local privileges can exploit this flaw to execute arbitrary code on the affected system. The vulnerability is tracked as CWE-122 (Heap-based Buffer Overflow). Microsoft has published an official fix to address this issue.

Successful exploitation could allow an authorized local attacker to execute arbitrary code with elevated privileges, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at the time of publication.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20922 to remediate this vulnerability.