A use‑after‑free flaw in the Microsoft Graphics Component can be triggered by an authorized local user, enabling the execution of code with elevated privileges. The vulnerability, identified as CWE‑416, allows the attacker to gain higher privileges on the affected Windows system, potentially leading to full system compromise.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 22H3) as well as Windows Server 2016, 2019, 2022, and the 2025 release.

The CVSS score is 7.8, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation in the current environment. The vulnerability requires a privileged, local attacker and is not listed in CISA’s Known Exploited Vulnerabilities catalog, meaning no widespread compromise reports exist yet. Because the flaw involves a use‑after‑free in a core component, exploitation could allow arbitrary code execution if an attacker successfully controls the graphics request path, but the attack vector is confined to local user context.