An out‑of‑bounds read flaw in the Microsoft Graphics Component can allow a local attacker to read memory beyond the bounds of a buffer, leading to the disclosure of sensitive information. This type of vulnerability (CWE‑125) could expose data that is not intended to be publicly visible, such as user credentials, cryptographic keys, or other confidential data residing in process memory.

Affected systems include Microsoft Office for Android and multiple Windows 10 releases (1607, 1809, 21H2, 22H2) as well as Windows 11 releases (23H2, 24H2, 25H2, 22H3, 26H1). Server editions impacted are Windows Server 2012 (including Core deployments), 2012 R2, 2016, 2019, 2022 (including a 23H2 Core edition) and the upcoming Windows Server 2025. All affected versions are listed in Microsoft’s advisory under CVE‑2026‑25180.

The vulnerability has a CVSS score of 5.5, indicating a moderate risk level, and an EPSS score of less than 1%, implying a low likelihood of exploitation in the wild. It is not present in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be local, meaning a user or process on the affected machine must invoke the vulnerable component; remote exploitation is not supported by the CVE description. Because exploitation requires unintended memory access within a single user context, the potential impact is limited to data that the local user can normally read.