A heap‑based buffer overflow in the Microsoft Graphics Component allows an attacker who can run code on a Windows system to trigger a write outside the bounds of a heap buffer, which can lead to the execution of arbitrary code with the privileges of the user. The vulnerability is triggered by crafted data supplied to the component and does not require network connectivity or elevated privileges to activate.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server releases 2012 R2, 2016, 2019, 2022, and 2025. All installations, including Server Core and full desktop editions, are affected.

The CVSS score of 7.8 denotes high severity with a local attack vector; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Because an attacker only needs local code execution, the risk is limited to compromised accounts on the machine. Successful exploitation could allow the attacker to gain control over the system, but would not provide remote access by itself. The attack requires an ability to execute code on the target system, which is typically achieved through social engineering or other local compromise mechanisms.