The vulnerability is a race condition in the Win32K GRFX component that can be triggered by an authorized local user. By manipulating the shared resource, the attacker can cause improper synchronization that leads to a privilege escalation, allowing the execution of code with higher privileges. The weakness is represented by CWE-362 (Race Condition) and CWE-416 (Use After Free).

A large range of Windows operating systems are impacted. Microsoft Windows 10 from Version 1607 through 22H2, Windows 11 versions 23H2, 24H2, 25H2, 22H3, and 26H1, as well as Windows Server 2012 through 2025 (including all Server Core installations) are listed as affected. The issue exists in both 32‑bit and 64‑bit builds, and in ARM64 versions where applicable.

The CVSS score of 7 indicates medium severity. The EPSS score is not available, and KEV does not list this vulnerability as a known exploited vulnerability, suggesting that it has not yet been observed in widespread attacks. The attack vector appears to be local; an authenticated user must produce a race condition within the Win32K GRFX component to trigger the race. Because the flaw requires local privilege to gain elevation, exploitation is unlikely to be remote or require network access. Defender or other security solutions should be configured to detect anomalous local privilege escalation attempts. Supporting evidence: none reported, so the feasibility currently relies on the documented race condition.