ecosystem of xml > tlv > null-terminated strings / utf16 for user input make an off by one error anywhere or unverified* malicious user input in the house of ca

ecosystem of xml > tlv > null-terminated strings / utf16 for user input make an off by one error anywhere or unverified* malicious user input in the house of cards of technical debt in any MS ecosystem collapse into minefield of privilege escalation, RCE, etc horizontal pivots...not trivial, however. this bug is essentially a retro-active pivoting platform for the lucky day you combine unsanitized input and context escape. seems like just trivial digital sticker-swapping, but MS over-leveraging its successes, refusal to break things (to maintain backwards compatibility, and it's own technical debt..), mean that some mistakes, however trivial, yet affecting, are immortalized