The vulnerability is a use‑after‑free bug in the Microsoft Graphics Component that permits a local, authorized attacker to gain higher privileges on the affected system. The flaw allows the attacker to perform actions with elevated privileges. The weakness is classified as CWE‑416, a memory‑management error where freed memory is accessed.

Affected versions include Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, across both desktop and core installations.

The severity is rated at a CVSS score of 7.8, indicating a high impact if exploited. The EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is local: an attacker who can run code or have user level access on the target machine can trigger the use‑after‑free, leading to privilege escalation.