An out‑of‑bounds read in the Windows Graphics Device Interface (GDI) enables a local attacker to read memory that it should not be able to access. The disclosed information could contain any data residing in the victim’s process memory, including sensitive credentials or other confidential information. The weakness is addressed by CWE‑125.

The vulnerability affects Microsoft Windows operating systems starting with Windows 10 Version 1607 through Windows 11 Version 26H1, as well as all major Windows Server releases including Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025 and the 23H2 edition. All supported processor architectures—x86, x64, and ARM64—are included, and the list additionally includes the Windows 11 Version 22H3 release that is present in the known vendors table.

The CVSS base score of 5.5 indicates a moderate severity. The exploit requires the attacker to have local access to the affected machine; no remote attack vector is documented. The EPSS score is not available, and the vulnerability is not listed in the CISA Known Exploit Vulnerabilities catalog, suggesting that widespread exploitation has not been observed.