Stack-based buffer overflow in the Windows Codecs Library can be triggered by a malicious media file sent over a network. The flaw allows an unauthenticated attacker to cause the codec to crash, leading to a denial of service for the affected system. The weakness is a classic stack corruption bug (CWE‑121).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012 (including Server Core), 2012 R2 Server Core, 2016, 2019, 2022, and 2025. These variants are listed by Microsoft as affected in their advisories.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is publicly available, so the exploitation likelihood cannot be precisely quantified, but the lack of a CISA KEV listing suggests it is not yet widely used by threat actors. The attack vector is inferred to be remote, requiring network delivery of a crafted media file, and the flaw can be exploited by an unauthenticated attacker. Prompt remediation is advisable.