The vulnerability is a heap-based buffer overflow in the Windows Rich Text Edit control. An attacker who can supply specially crafted input over a network can trigger the overflow and execute arbitrary code, effectively taking full control of the affected system.

Microsoft 365 Apps for Enterprise, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and their server core variants. All affected editions are listed in the Microsoft advisory.

The CVSS score of 9.8 classifies this as critical. The EPSS score is currently unavailable, but the lack of KEV listing does not reduce the severity. The vulnerability can be exploited remotely by delivering malicious Rich Text input to any process that loads the control, so an attacker with network access to a vulnerable machine can potentially execute code with the rights of the process. The high score and remote nature mean that exploitation could be widespread if patched versions are not deployed.