The vulnerability is a heap‑based buffer overflow in the Microsoft Windows Search Component that permits an unauthorized attacker to execute arbitrary code on a target system via the network. This flaw allows remote code execution, potentially giving the attacker full control over the affected machine.

Affected systems include a wide range of Microsoft Windows operating systems: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025. All listed variants are impacted across both 32‑bit and 64‑bit builds as well as ARM64 where applicable.

The CVSS score for this vulnerability is 8.8, indicating a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote and may not require authentication, as the description states an "unauthorized attacker" can execute code. Exploiting this flaw does not require local privileges or user interaction beyond network access to the target device. No specific exploitation conditions are disclosed beyond the need for network reach.