Integer underflow (wrap or wraparound) in Microsoft UxTheme Library (uxtheme.dll) enables an attacker who is not authenticated to execute code on the target system. This flaw arises from improper handling of numeric values during the processing of theme data, allowing a crafted payload to overflow a signed integer and overwrite memory, which results in a high‑severity remote code execution vulnerability that can compromise confidentiality, integrity, and availability of the affected machine.

Affected systems include all Microsoft Windows 10 releases from version 1607 through 22H2, all Microsoft Windows 11 releases from 23H2 through 26H1, and Windows Server editions from 2012 (both standard and server core) up to and including Windows Server 2025. The vulnerability resides in the uxtheme.dll component of these operating systems, and any system that loads the library can be impacted.

The CVSS score of 9.8 indicates a critical impact level. The EPSS score is not available, so the probability of exploitation is currently unknown, but the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector is a network‑based interaction that triggers the library to process malicious theme data; therefore an attacker does not need local privileges to exploit the flaw. Given the high severity, the risk remains significant for all systems that have not yet applied the security update from Microsoft, even if the exploitation rate has not yet been observed.