A heap‑based buffer overflow in the Windows Media Foundation component allows an authorized attacker to write beyond intended memory bounds. The overflow, if triggered by crafted media data, enables execution of code within a process that normally runs with elevated system privileges. This can lead to an attacker gaining administrator or system level access on the compromised machine, thereby exposing all data and potentially compromising additional resources.

The flaw is present in a broad range of Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and Server Core installations. It affects x86, x64, and ARM64 architectures where applicable.

The CVSS score of 7.8 indicates a high severity local privilege escalation vulnerability. The EPSS score is below 1 %, implying a low probability of exploitation at this time, and the vulnerability is not yet listed in CISA KEV. Exploitation requires an attacker who can supply malicious media to a privileged Media Foundation process, meaning the attack vector is local and typically an authorized or partially privileged user. Given the lack of publicly available exploits, prompt remediation is the most effective defense.