Use after free in the Windows Win32K graphics subsystem (GRFX) allows a local, authorized attacker to perform actions with elevated privileges. The flaw results from a dangling pointer that is dereferenced after the memory has been freed, enabling the attacker to attain administrative or SYSTEM level rights on the affected system. This weakness is identified as CWE-416 (Use After Free) and CWE-190 (Integer Overflow or Wraparound).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. Devices running any of these operating systems are potentially vulnerable unless updated.

The CVSS score of 7.8 indicates a high severity of impact if the vulnerability is exploited. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Attackers must have local, authorized access to initiate the exploit; they can then raise their privileges to admin or SYSTEM, enabling full control over the compromised machine. No public exploit evidence is available in the data, but the severity requires prompt patching.