An untrusted pointer dereference in the Windows Object Linking and Embedding (OLE) infrastructure permits an attacker to execute arbitrary code on a target system without authorization. This flaw is a classic input handling weakness that, when triggered by malicious OLE data sent over the network, results in execution of attacker‑controlled code with the privileges of the user running the OLE services. The vulnerability is classified as CWE-822, indicating that valid pointers are not properly validated before dereferencing.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Microsoft Windows 11 versions 23H2 through 26H2 and the 26H1 edition, as well as Windows Server 2012 through 2025 – including core and standard installations – are all affected. All listed editions are impacted by the same untrusted pointer dereference flaw.

The CVSS score of 9.8 marks this vulnerability as critical. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. Based on the description that the flaw permits code execution over a network, the likely attack vector involves a remote attacker crafting and delivering malicious OLE data through standard network protocols such as SMB or the OLE Automation interface. If successful, the attacker can run code under the privileges of the target user, potentially compromising system integrity and availability. The absence of a publicly available exploit in KEV suggests that either exploitation is still in development or limited in the wild, but the high severity and network‑based nature warrant urgent remediation.