An out‑of‑bounds write occurs in the Windows PDF reader, allowing an attacker to execute arbitrary code on a vulnerable machine. The flaw, mapped to CWE‑787, can be triggered by loading a specially crafted PDF file. If successful, the attacker gains the privileges of the affected user process, potentially compromising confidentiality, integrity, and availability of the system.

The vulnerability affects Microsoft Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows Server 2022, and Windows Server 2025 (including Server Core installations). All listed operating system builds are susceptible; no specific patch version is yet defined in the data.

The CVSS score of 8.1 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based, with an unauthorized attacker able to deliver a malicious PDF over a network share or via a phishing link. Successful exploitation would allow remote code execution without authentication.