The Windows Media Player heap-based buffer overflow allows an attacker to execute code on the target machine with the privileges of the Windows user who is logged on. The flaw is identified as CWE‑122 and results in remote code execution that could be leveraged for full system compromise. Because the vulnerability can be triggered over a network, an attacker does not need local user interaction to abuse it.

All listed Microsoft Windows operating systems are affected, including Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (server core installations). The issue resides in the Windows Media Player component of these operating systems.

The CVSS score of 9.8 indicates a critical severity, while no EPSS data is available and the vulnerability has not yet entered the CISA KEV list. The vulnerability can be leveraged remotely via network traffic that interfaces with Windows Media Player, making it exploitable from outside the host. An attacker who can deliver specially crafted data over the network could trigger the overflow and gain arbitrary code execution on the system.