A heap-based buffer overflow in the Windows Text Shaping component allows an attacker to trigger a memory corruption scenario by sending specially crafted text. The flaw occurs when the component allocates heap memory without validating the input length, leading to code execution. An attacker could potentially execute arbitrary code, which may compromise confidentiality, integrity, and availability of the affected machine. The possibility of full system control and pivoting to other systems is inferred from the Remote Code Execution nature of the flaw but is not explicitly stated in the description. The vulnerability is classified as CWE-122.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012 (standard and Server Core), 2012 R2 (standard and Server Core), 2016, 2019, 2022, and 2025; supported on both x86 and ARM64 architectures as indicated by the available CPEs.

The CVSS score of 9.8 indicates critical severity. EPSS data is not available, so the exact likelihood of exploitation is uncertain. The vulnerability can be triggered over a network by an attacker sending malicious text to the vulnerable component. The vulnerability is not listed in CISA KEV, which does not negate its risk. If successfully exploited, an attacker could potentially execute code with system privileges, which may allow control of the host; such control and further compromise of other network assets is inferred from the RCE nature of the flaw.