A heap‑based buffer overflow exists in the Windows Media Foundation component that permits an unauthenticated attacker to execute arbitrary code over a network connection. The underlying weakness is a classic use‑after‑free or malformed payload exploitation (CWE‑122). Successful exploitation would compromise the confidentiality, integrity, and availability of the affected system as the attacker could remotely spin up arbitrary code with the privileges of the running process.

The flaw affects a wide range of Microsoft operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server editions such as Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025. Both x86 and x64 architectures, as well as ARM64, are documented as vulnerable.

The CVSS score of 9.8 categorizes this issue as critical, and while EPSS data is not publicly available, the lack of a KEV listing does not diminish the potential impact. The attack vector is inferred to be network‑based, requiring the attacker to deliver a crafted media file or stream to a vulnerable host without authentication. Once the overflow is triggered, arbitrary code runs in the context of the Media Foundation process, which typically has permission to affect system resources.