The vulnerability is a classic use‑after‑free error in the Windows Graphics Kernel that allows an authorized user to execute code with elevated privileges locally. When the kernel incorrectly accesses memory that has been freed, a crafted payload can be injected, giving the attacker system level rights and full control over the machine. This can lead to installation of malware, bypassing of security controls, and ultimately complete compromise of the affected system.

Affected customers include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations.

The CVSS score of 7.0 indicates a high severity vulnerability. No exploitation probability score is available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is local: an attacker who has the ability to run applications on the system—such as a user or process—could trigger the kernel error. Once exploited, the attacker gains full control, making the threat significant for organizations that rely on these Windows platforms.