The vulnerability is a use‑after‑free flaw in the Windows Win32K subsystem, specifically within the GRFX component. Because a reference to a freed kernel object can be accessed after deallocation, an attacker who is already authorized to run code on the machine can manipulate the memory layout and trigger privileged operations. This flaw allows the attacker to obtain elevated privileges, effectively gaining administrative rights on the affected system.

Affected Microsoft Windows products include Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H1, and the Windows Server line — 2019, 2022, 2025 including Server Core installations.

The CVSS score of 7.8 marks this flaw as high‑severity, and the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation. The lack of entry in CISA’s KEV catalog suggests no widespread exploitation has been observed yet. The likely attack vector is local, requiring the attacker to already have a user session on the compromised machine, after which the use‑after‑free can be triggered to elevate to administrative rights.