The vulnerability is a code injection flaw (CWE‑94) that allows an unauthenticated attacker to cause Microsoft Data Formulator to generate and execute arbitrary code. This results in remote code execution on the affected host, compromising confidentiality, integrity, and availability.

Microsoft Data Formulator is affected. No specific product versions are listed in the advisory, so the risk applies to all installed instances until a vendor update is released.

The CVSS score of 8.8 indicates high severity, and the EPSS score is not available, but the absence from the CISA KEV catalog suggests no documented exploitation yet. The attack vector is inferred to be remote over the network, requiring the attacker to transmit malicious input to the Data Formulator service. If exploited, the attacker could run arbitrary code with the privileges of the application process.