A heap‑based buffer overflow exists in the Microsoft MPEG‑2 Video Extension that allows an attacker to execute arbitrary code. This flaw can lead to full compromise of confidentiality, integrity, and availability on the affected system, as the attacker gains the ability to run arbitrary code with system privileges. The weakness is defined by CWE‑122: Heap-based Buffer Overflow.

The vulnerability affects Microsoft’s MPEG‑2 Video Extension component. No specific product versions are listed in the data, so all installations of the listed component are considered potentially impacted.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the combination of a network‑based trigger and lack of prior patch availability still makes it a serious risk. An attacker must be able to reach the vulnerable component over the network; once they do, exploitation requires only sending malformed data to trigger the overflow. No known workarounds are documented, so the only known defense is patching.