The vulnerability is a heap-based buffer overflow in the Microsoft Graphics Component. An attacker with local user privileges can craft inputs that cause memory corruption, allowing execution of arbitrary code. This can lead to compromise of the system and disclosure of confidential data, as the attacker gains the same privileges as the user who triggers the overflow.

Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 and its Server Core installation, are affected. No earlier or later releases are indicated.

The flaw received a CVSS score of 8.4, denoting high severity. EPSS is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. The likely attack vector is local, meaning the attacker must first log in or gain local access. If executed, the attacker can run arbitrary code with user-level privileges, which could be leveraged to elevate privileges or install malware. Monitoring for abnormal graphics activity and applying the patch quickly reduces risk.