Windows Text Shaping implements character shaping for rendering text. The flaw is a heap-based buffer overflow that an attacker can trigger by delivering specially crafted input over a network connection, resulting in arbitrary code execution with system privileges. The attack allows the attacker to compromise the confidentiality, integrity, and availability of the affected machine.

Affected are Microsoft Windows 10, 11, and Server versions. Publicly, impacted releases include Windows 10 1809, 21H2, 22H2, Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 9.8 classifies this vulnerability as critical, indicating that exploitation would grant high-level privileges. The EPSS score is not available, and the vulnerability does not appear in the CISA KEV catalog, but the high CVSS remains a strong indicator that attackers are likely to target it. Exploitation requires network access to the vulnerable component; once the attacker sends the crafted data, control flow can be redirected and code executed.