The vulnerability is a heap-based buffer overflow in the Windows Text Shaping component that allows an unauthenticated attacker to execute code over a network. If exploited, an attacker could gain full code execution rights on the affected system, compromising the confidentiality, integrity, and availability of the machine. The weakness is characterized as a heap-based buffer overflow (CWE‑122).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, as well as 23H2 and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core variants. Affected architectures include x86, x64, and arm64.

The CVSS score of 9.8 reflects a critical level of risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can deliver malicious text via any network interface that triggers the Text Shaping subsystem, potentially without requiring local user interaction.