A heap-based buffer overflow occurs in the Microsoft Internet Messaging API. When an authorized user or a process with sufficient privileges triggers the vulnerability, an attacker can execute arbitrary code within that process, effectively gaining local code execution. The weakness is a classic stack or heap overflow identified as CWE-122.

The flaw affects Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1 on both ARM64 and x64 platforms. It also targets Windows Server 2012 through 2025 and Windows Server 20xx Core installations. All mentioned builds include the vulnerable Internet Messaging API component.

The CVSS score of 7.8 indicates a moderate to high severity, while the EPSS score is not available, suggesting insufficient data on current exploitation probability. Because the vulnerability requires local, authorized access to trigger the overflow, it is not a remote exploit but still poses a significant risk to users with administrative or equivalent privileges. The vulnerability is not listed in the CISA KEV catalog, so no known large-scale exploitation has been publicized.