A heap-based buffer overflow in Microsoft Windows Media Foundation permits an unauthorized attacker to execute code on an affected system. This flaw is a classic example of indeterminate buffer length handling (CWE-122), allowing arbitrary code execution when a specially crafted media file is processed. The impact is remote code execution that could lead to full system compromise, data theft, or further lateral movement.

A broad range of Microsoft Windows operating systems are affected, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and various Windows Server releases from 2012 through 2025. All listed editions (desktop and server core) are vulnerable.

The CVSS score of 9.8 labels this flaw as critical. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, making the exact exploitation probability unclear. The likely attack vector is network-based; an attacker must deliver a malicious media file to a target that has Media Foundation enabled, without needing local privileges. Successful exploitation would give the attacker the same privileges as the Media Foundation process, potentially allowing full system compromise.