An out‑of‑bounds read in the Windows Text Shaping component allows an unauthenticated attacker to trigger remote code execution over a network. The vulnerability stems from improper bounds checking (CWE‑125) combined with a numeric truncation flaw (CWE‑197), enabling control over program execution and compromising confidentiality, integrity, and availability of the affected system.

Affected are Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012 (Standard and Core), 2012 R2 (Standard and Core), 2016, 2019 (Standard and Core), 2022, and 2025 (Standard and Core).

With a CVSS score of 8.8, the exploit poses a high security risk. The EPSS value is unavailable, but the vulnerability is not listed in CISA’s KEV catalog, indicating there is no known widespread exploitation yet. Nevertheless, the attack vector is over a network and does not require local privileges, which makes it highly dangerous for exposed or semi‑exposed systems.