Buffer over‑read in the Windows GDI+ graphics subsystem can be triggered by an external input, leading to a denial of service. The flaw allows an unauthorized attacker to send crafted data over a network to crash the service or the entire operating system. The resulting impact is a loss of availability for affected applications and, potentially, the entire host, without compromising confidentiality or integrity.

The vulnerability touches Microsoft product lines that include Windows 10 (all feature‑level releases from 1607 through 22H2 and 26H1), Windows 11 (up through 26H1, including 23H2, 24H2 and 25H2), various Windows Server releases from 2012 to 2025, and Microsoft Office for Android. All named builds are impacted regardless of architecture.

The CVSS score of 7.5 classifies the flaw as high‑severity, and the EPSS score of less than 1 % suggests a very low probability of exploitation at present. Because the attack vector is network‑based, an attacker must reach the vulnerable system over a network, and no public exploit code is currently available. The CVE is not listed in the CISA KEV catalogue, indicating no confirmed attacks in the wild.