The heap‑based buffer overflow in Microsoft XML allows an attacker with network access to supply malicious XML that triggers arbitrary code execution. The flaw stems from improper bounds checking during memory allocation, identifying it as a CWE‑122 weakness. An unauthenticated or low‑privileged attacker can thus compromise confidentiality, integrity, and availability of the affected system.

Microsoft Windows includes the vulnerable XML parser in a wide range of releases. The affected OSs are Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases from 2012 through 2025, including Server Core installations. The vulnerability applies to all listed x86, x64, and arm64 builds.

The CVSS base score of 9.8 indicates a critical risk with full remote exploitation potential. EPSS data is not available, so the current exploitation likelihood is unknown, although the lack of a KEV listing suggests no publicly known exploit yet. The flaw can be triggered over the network by sending crafted XML to any component that consumes Microsoft XML, making it a high‑value target for attackers. Immediate remediation is strongly recommended.