The vulnerability consists of a null pointer dereference in the Windows DirectX graphics kernel that can be triggered by an authorized user, leading to a local denial of service. An attacker who is already authenticated or has authorized access can cause the system to become unresponsive or unstable without compromising data confidentiality or integrity. The impact is limited to the affected machine and is not a remote or privilege‑escalation flaw.

Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 22H3, 23H2, 24H2, and 25H2, and Windows Server 2022 (including Server Core 23H2 Edition) and Windows Server 2025 (including Server Core).

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authorized access and a trigger that causes the DirectX graphics kernel to dereference a null pointer, likely through specially crafted graphics input or a fault in DirectX processing. Given the local nature and need for authorized use, the attack vector is limited to privileged users or a compromised local session.