The vulnerability is a use‑after‑free bug in the Microsoft Graphics Component that permits a local, authorized attacker to execute actions with elevated privileges on the affected system. This flaw allows the attacker to gain higher access than intended, potentially compromising system confidentiality, integrity, and availability. The weakness is classified as CWE‑416, indicating a memory management error where freed memory is accessed.

Affected versions include Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, across both desktop and core installations.

The severity is rated at a CVSS score of 7.8, indicating a high impact if exploited. The EPSS score is not available, so the probability of exploitation cannot be quantified at this time. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is local: an attacker who can run code or have user level access on the target machine can trigger the use‑after‑free, leading to privilege escalation.