The flaw is a heap‑based buffer overflow in Windows Shell that allows an unauthorized attacker to send specially crafted data over a network and execute arbitrary code. This results in remote code execution with the privileges of the Windows Shell service, compromising the confidentiality, integrity, and availability of the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.

The CVSS base score of 9.8 marks this as a critical vulnerability. The EPSS score is less than 1 %, indicating a very low exploitation probability, but the critical severity still necessitates prompt action. The flaw is not listed in the CISA KEV catalog. The description indicates that an unauthenticated remote attacker can exploit the vulnerability by sending network traffic to the Windows Shell service, enabling code execution from any host that can reach the affected system.