A heap‑based buffer overflow in the Windows GDI subsystem permits a local attacker to execute arbitrary code with the privileges of the user running the compromised process. Because GDI handles graphical data from third‑party files and applications, a malicious file can trigger the overflow and replace existing heap data, providing the attacker a foothold for arbitrary code execution. The flaw aligns with CWE‑122 and can lead to full compromise of the affected machine if the attacker can obtain local access or social‑engineer a user into opening a crafted payload.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; Windows Server 2012, 2012 R2; Windows Server 2016, 2019, 2022, 2025; Windows Server 23H2 edition; and corresponding Server Core installations. All cited builds are impacted by the GDI buffer overflow flaw.

The CVSS score of 7.8 indicates a high risk when the vulnerability is active. EPSS data is not available, but the flaw does not require privileged execution and can be triggered by a malicious document or image, meaning an attacker with local access or the ability to trick a user may exploit it. The vulnerability is not listed in CISA's KEV catalog, suggesting no confirmed public exploits as of this analysis. Nonetheless, the high severity and ease of local exploitation warrant prompt remediation.