The vulnerability is a heap‑based buffer overflow in the Windows GDI subsystem that permits an unauthorized attacker to execute arbitrary code over a network. This flaw is mapped to CWE-122 and carries a CVSS score of 8.8, indicating high severity and a significant threat to confidentiality, integrity, and availability of affected systems.

Affected systems include Windows 10 releases starting with version 1607 through 22H2, Windows 11 releases from 23H2 onward through 26H2, and all major Windows Server editions from 2012 to 2025, including their Server Core installations. The GDI component is present in each of these products, and any instance that processes untrusted graphics data is potentially vulnerable.

With a high CVSS score but no EPSS score available, the overall exploitation probability is unknown, though the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can deliver malicious data to the GDI subsystem over the network to trigger the buffer overflow and gain code execution. No additional conditions are specified in the CVE description, so the flaw can be leveraged by any user capable of sending data to the affected system.