A heap-based buffer overflow exists in Windows Media Foundation that permits an attacker with local access to execute arbitrary code on the affected system. The flaw arises when the media framework processes malformed input, corrupting memory and compromising process integrity. Because the vulnerability is local, the attacker must already have some level of user or process access to the machine, but locally executing code can lead to privilege escalation or persistence within the operating system.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 24H2, 25H2 and 26H1; Microsoft Windows Server 2016, Windows Server 2019, Windows Server 2022 and Windows Server 2025, including Server Core installations where specified. All x86, x64, and arm64 builds documented in the CVE's affected CPE strings are impacted.

The CVSS score of 7.8 indicates a high severity level, while the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a local actor feeding crafted media content to the vulnerable component; because the flaw requires local execution and is limited by heap corruption, it may require specific trigger conditions or user interaction. Given the low EPSS and absence from KEV, widespread exploitation is currently unlikely, but the potential for local privilege escalation makes a timely patch essential.