A heap‑based buffer overflow exists in the Windows Imaging Component that permits an unauthorized attacker to execute arbitrary code when the component processes a malicious image or media file sent across a network. The flaw can corrupt memory, compromise the confidentiality, integrity, and availability of the affected host, and potentially elevate privileges to obtain full system control. The CVSS score of 9.8 reflects its near‑critical severity.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, and the Server Core variants. The vulnerability applies to both 32‑bit and 64‑bit builds as listed in the CPEs.

The extremely high CVSS score indicates that exploitation would have a catastrophic impact. Because the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, the likelihood of a widespread attack vehicle is currently unknown; however, the description states that an attacker can execute code over a network, so the attack vector is inferred to be remote and network‑based. The absence of a known workaround means the only known mitigations are the official Microsoft updates.