This vulnerability is a heap‑based buffer overflow in Microsoft Windows Media Foundation that lets an attacker execute arbitrary code on the target machine by sending specially crafted media data over the network. The attacker need not authenticate; the flaw occurs in the media parsing component, which makes it a remote code execution weakness. Because the vulnerability arises from an unchecked buffer copy in the Media Foundation pipeline, a successful exploit compromises confidentiality, integrity, and availability of the affected system.

Affected products include Microsoft Windows 10 1607, 1809, 21H2, 22H2, Microsoft Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including the Server Core installations).

The CVSS base score is 8.8, indicating high severity. EPSS is not available, so current exploit probability is unknown, but the flaw is listed as a remote code execution with no authentication, so the risk remains high. The issue is not yet cataloged in CISA’s Known Exploited Vulnerabilities list. Attackers could reach the vulnerable component via network traffic containing malicious media files; no local privilege escalation is required. Because no public exploit is disclosed, organizations should assume the threat might exist in the wild.