Microsoft Windows Codecs Library contains an integer overflow or wraparound flaw that allows an attacker to trigger code execution on the target system. The overflow occurs when processing HEVC (High Efficiency Video Coding) data, which can be supplied over a network connection. As a result, an unauthorized attacker could gain arbitrary code execution privileges on affected devices, potentially compromising confidentiality, integrity, and availability of the system.

The vulnerability affects Microsoft HEVC Video Extensions, Microsoft HEVC Video Extensions for Licensed Applications, and Microsoft HEVC Video Extensions from Device Manufacturer. No specific version information is provided in the current data, so any installation of these extensions is assumed to be at risk until further details are released.

The flaw is rated CVSS 8.8, indicating a high severity level. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote over a network, as the overflow is triggered by unattended processing of HEVC data. Because the vulnerability permits arbitrary code execution, the risk is significant for any system without an applied fix.