A heap‑based buffer overflow exists in the Microsoft PostScript Printer Driver that allows an attacker to run arbitrary code when the driver processes malicious PostScript data. The flaw, classified as CWE‑122, can enable full compromise of the system by executing code with the privileges of the print spooler service.

The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicate), and 26H1; and all Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, both standard and Core installations, on supported hardware architectures including x86, x64, and arm64.

The CVSS score of 9.8 marks the issue as critical, indicating loss of confidentiality, integrity and availability. The EPSS score is not available, so the probability of exploitation remains undefined, but no known exploit exists yet; the flaw can be triggered by an attacker sending crafted PostScript traffic to the print spooler over the network. The vulnerability is not listed in CISA’s KEV catalog, but its severity warrants urgent attention. The likely attack vector is via network communication to the printer service, inferred from the description that the flaw can be triggered by an attacker on a network.