The Microsoft PostScript Printer Driver has a heap‑based buffer overflow that permits an unauthorized attacker to execute code over a network connection. This flaw can be used to run arbitrary instructions within the context of the driver, potentially compromising the affected system.

Affected are Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including both standard and Server Core installations. The vulnerability spans x86, x64 and arm64 architectures as represented in the CPE data.

The CVSS score of 9.8 indicates a critical severity and reflects remote code execution with no user interaction. EPSS is not available, so current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. Nonetheless, the remote nature of the vector and high severity mean that organizations should treat it as high risk and remediate immediately.