A heap-based buffer overflow exists in the Windows Media Video Decoder, which can allow an unauthorized attacker to execute code on a target machine over a network. The flaw enables arbitrary code execution, granting the attacker complete control over the affected system. This vulnerability falls under CWE-122 and represents a significant breach of confidentiality, integrity, and availability.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 in both standard and Server Core installations.

The CVSS score of 8.8 classifies this as high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based, requiring delivery of a crafted file or payload to the Windows Media Video Decoder. Given the remote code execution capability and lack of mitigations, the risk of exploitation is considerable for systems without timely patching.