A critical flaw in the Microsoft Devices Pricing Program allows remote code execution. An attacker who can target the program can run any code with the privileges of the system, potentially compromising devices and data. The vulnerability corresponds to CWE‑434, indicating that untrusted content is accepted without proper validation.

All deployments of Microsoft Devices Pricing Program are potentially affected; the advisory does not specify any version restrictions, so every installation should be evaluated.

The CVSS score of 9.8 indicates an extremely severe risk, yet the EPSS score is 2%, implying limited exploitation activity to date. The vulnerability is not listed in the KEV catalog, and no widespread attacks have been reported. The likely attack vector is remote, exploiting exposed interfaces or services of the program.