A heap‑based buffer overflow in the Windows Imaging Component allows an unauthenticated attacker to execute arbitrary code over a network. The flaw can be triggered by sending a malicious image that causes the component to write beyond the bounds of an allocated buffer, giving the adversary full control of the affected system. This results in a remote code execution vulnerability that threatens confidentiality, integrity, and availability of the compromised machine.

Affected Windows 10 releases 1607, 1809, 21H2, 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H1, 26H2; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including Server Core installations.

The CVSS score of 8.8 denotes a high severity, indicating that successful exploitation would likely give the attacker complete control. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no confirmed widespread exploitation yet. Nevertheless, because the flaw is network‑accessible through the Windows Imaging Component, an attacker can potentially craft a malicious image and serve it to a target system, triggering the overflow. In the absence of a published exploit, the risk remains theoretical but high, so patching is strongly advised.