A heap-based buffer overflow exists in the Microsoft Graphics Component. The flaw can be triggered by crafted data that allows an authorized local user to write beyond the bounds of a heap buffer, enabling the execution of arbitrary code with elevated privileges. This results in the compromised process gaining the privileges of the Windows user that owns the graphics session, potentially allowing the attacker to acquire administrative rights on the affected system.

Microsoft Windows 11 version 26H1 running on the arm64 architecture is affected.

The CVSS score of 7 indicates a moderate severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers would need local access to the machine and would need to interact with the vulnerable graphics component, such as by running a malicious program or manipulating the graphic pipeline, to trigger the overflow. The vulnerability is classified as a buffer overflow (CWE-122), making it potentially exploitable if the attacker can supply malicious input.