Heap‑based buffer overflow in the Windows Graphics Fonts component can be triggered by an attacker who controls a font file that the victim system loads from the network. The overflow can corrupt heap memory and allow arbitrary code execution with the privileges of the current user. The vulnerability is a classic memory corruption flaw (CWE‑122).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012, 2016, 2019, 2022, 2025 and their core installations are affected. The advisory lists specific builds for both x86 and x64 and arm64 architectures.

The CVSS score of 8.8 indicates high risk, and the lack of EPSS data means current exploitation probability is unknown but could be high due to the criticality of font handling. The vulnerability is not yet listed in CISA KEV, but Microsoft has released a patch. Attackers would need to supply a malicious font file over the network, which can be accomplished through shared folders or remote rendering requests. The required privilege is local user or user‑to‑system level depending on how the font is loaded.