The vulnerability is an integer overflow or wraparound in the Windows Win32K graphics component (GRFX). An unprivileged attacker can use this flaw to execute arbitrary code on the target system. The issue is catalogued as CWE‑190 and can lead to full compromise of the affected machine without external network access.

Affected products include Microsoft Office for Android applications—Excel, PowerPoint, and Word. Windows 10 releases 1607, 1809, 21H2, and 22H2, Windows 11 releases 23H2, 24H2, 25H2, and 26H1, and Windows Server releases from 2012 through 2025 are also impacted. No specific version subset is listed, indicating all versions of those products are vulnerable.

The CVSS score of 7.8 marks the flaw as high severity with potential for full system compromise. Although the EPSS score is not available, the flaw is not listed in the CISA KEV catalog. Exploitation requires local access; an attacker must supply crafted graphics input that triggers the overflow, likely during normal user interaction with Office files or graphical content on the device.