Protection mechanism failure in the MSHTML framework allows an attacker to bypass a built‑in security feature when processing content received over a network. The flaw is a security misconfiguration (CWE‑693) that permits the attacker to supply crafted input to the MSHTML parser, causing safety checks to be circumvented. The bypass can enable the attacker to perform operations that the security feature is designed to block, compromising the integrity or confidentiality of data processed by the component.

Microsoft Windows 10, version 1607, 1809, 21H2, 22H2 and Windows 11, versions 22H3, 23H2, 24H2, 25H2, 26H1 are affected. Server editions including Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and the 23H2 edition are also impacted. All bit‑architectures (x86, x64, arm64) and server‑core installations are included.

The CVSS score of 8.8 denotes high severity, while an EPSS score of 28 % indicates a high likelihood of exploitation in the wild. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, confirming that attackers have already deployed exploitation in real environments. The attack vector is inferred to be remote, originating from malicious content transmitted over a network that causes the MSHTML component to process it. Exploitation requires that the vulnerable application or service be reachable and that the attacker can supply crafted input to the MSHTML parser.