The vulnerability is a race condition caused by improper synchronization of a shared resource in the Windows Win32K GRFX component, allowing an authorized local attacker to elevate privileges. The flaw falls under CWE-416, indicating that a program improperly accesses memory after it has been freed. Once exploited, the attacker could gain higher privileges than originally intended, potentially allowing full system control and the installation of privileged software or unauthorized changes to system configuration.

Affected systems include Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Microsoft Windows Server 2025 in both full and Server Core installations. The CVE notes arm64 variants for Windows 11 24H2 and 25H2, and an x64 variant for Windows 11 26H1, indicating that the vulnerability spans multiple processor architectures.

The CVSS score of 7.8 places this flaw in the high severity range. The EPSS score of 0.00066 indicates a very low probability of exploitation, yet the high severity means the vulnerability remains significant. It is not listed in the CISA KEV catalog, suggesting there is no widespread evidence of active exploitation yet. The attack vector is inferred to be local; an attacker must already have access to the target system and sufficient privileges to execute code that can trigger the race condition in the Win32K GRFX component.