This vulnerability arises from a divide‑by‑zero condition in Microsoft’s Graphics Component, which can cause a local denial of service when exploited by an unauthorized attacker. The flaw leads to a crash of the graphics subsystem, potentially terminating or severely disrupting any applications relying on graphical output. The impact is primarily confined to the affected machine, as the attacker must be able to execute code locally to trigger the crash, and there is no evidence of remote exploitation.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1, as well as a range of Windows Server releases including 2012, 2012 R2, 2016, 2019, 2022, 2025 and their Server Core installations are affected. The vulnerability has been identified across both x86 and x64 architectures, and some ARM64 builds of the newer Windows 11 editions.

The CVSS score of 6.2 classifies the issue as medium severity, while an EPSS score below 1% indicates a low likelihood of current exploitation. The CVE is not listed in CISA’s KEV catalog. Because this flaw requires local code execution, the attack vector is a local attack that typically necessitates administrative or user privileges on the target system. With the vulnerability’s limited scope and the low EPSS, the overall risk is moderate but noteworthy for environments where uptime is critical.