A heap-based buffer overflow exists in the Windows Media component. The flaw arises from lack of boundary checks on incoming data, allowing an attacker to execute arbitrary code. This exploit can lead to local privilege escalation or complete system compromise. The weakness is identified as CWE-122.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025. Affected architectures include x86, x64, and arm64 where applicable.

The CVSS score of 7.8 indicates moderate‑high severity. The EPSS score is not available, so the exact exploitation probability remains unknown; however, the absence of an EPSS value does not negate the potential for high risk. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation, but that status should be re‑checked. The likely exploitation path requires an attacker to deliver malicious media content to a local user or compromise an account with file‑processing privileges. Once triggered, the attacker can run arbitrary code on the affected system.