The Windows Graphics Component contains a heap‑based buffer overflow that an attacker who already has local user rights can exploit. By causing the overflow, the attacker can make the component write arbitrary data into adjacent memory, which can alter execution flow and ultimately grant the attacker higher privileges on the local machine. This flaw is classified as CWE‑122 (Heap-based Buffer Overflow) and CWE‑787 (Out-of-Bounds Write).

Microsoft has identified the flaw in several Windows releases, including Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2 and 22H3, and a range of Windows Server editions from 2012 through 2025. The issue appears in both 32‑bit and 64‑bit builds, as well as ARM64 where applicable.

The CVSS score of 7.8 indicates a high impact if the vulnerability is successfully exploited. The EPSS score of less than 1 percent suggests that, at the moment, the likelihood of exploitation observed in the wild is low, and the vulnerability is not listed as a known exploited vulnerability in the CISA catalog. However, because the flaw enables a local privilege escalation and requires no special network exposure, an adversary with local access could immediately gain escalation. The attack path would involve running a malicious or modified application that triggers the graphics component, thereby corrupting the heap and executing arbitrary code with elevated rights.