This vulnerability is a heap-based buffer overflow in Windows Media that allows an unauthorized user to execute arbitrary code locally on the affected system. The flaw stems from insufficient bounds checking on input data handled by the media component, which is typical of CWE‑122. If successfully exploited, the attacker would gain the privileges of the user running the Windows Media process, potentially elevating impact to system‑wide compromise depending on the user’s rights.

Microsoft Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, and Microsoft Windows Server 2019, 2022, 2025 (including Server Core editions). The list is derived from the CNA vendor and product entries and the associated CPE classifications in the CVE data.

The CVSS score of 7.8 classifies this as high severity, while the EPSS score of less than 1% indicates a very low current exploitation likelihood. It is not listed in the CISA KEV catalog, suggesting no public exploit has been identified yet. Based on the description, it is inferred that the attack vector involves a specially crafted media file processed by Windows Media; an attacker must have some level of access to inject such a file, typically through remote upload or local user interaction with a malicious piece of content.