This vulnerability (CVE-2026-41104) in Microsoft Planetary Computer Pro (GeoCatalog) is caused by unsafe deserialization of untrusted data. Exploitation can lead to unauthorized information disclosure over a network. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction, has network attack vector, and results in complete compromise of confidentiality, integrity, and availability. Microsoft has published an official fix to address this vulnerability.

Successful exploitation allows an unauthenticated attacker to remotely disclose sensitive information, potentially compromising confidentiality, integrity, and availability of the affected system. The critical CVSS score reflects the severity and ease of exploitation without user interaction or privileges.

An official fix is available from Microsoft. Users and administrators should apply the vendor-provided patch promptly to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41104 for detailed update instructions.