Windows Media contains a heap‑based buffer overflow that an attacker can trigger by sending carefully crafted media data to the service. Exploiting the flaw allows arbitrary code execution with the same privileges as the Windows Media service, potentially leading to full system compromise. The vulnerability directly affects confidentiality, integrity, and availability of the affected machines.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2), Microsoft Windows Server 2012–2025 (including core installations and all supported architectures). The flaw also impacts Windows 11 version 26H2 for ARM64 based systems.

The CVSS score of 7.5 signals moderate to high risk, and because the EPSS score is not available the likelihood of exploitation is unknown. It is not yet listed in the CISA KEV catalog. The data suggests the vulnerability can be exploited remotely over the network by an attacker with no prior privileges, making it a high‑impact attack vector. Administrators should prioritize applying the Microsoft patch as soon as it becomes available.