A stack-based buffer overflow in the Windows GDI subsystem enables an authorized local attacker to elevate privileges, allowing the execution of code with higher rights than originally granted. The vulnerability is identified as CWE-121 and can compromise system integrity by permitting unauthorized actions typically reserved for privileged users.

Affected products include Microsoft Windows 10 (Versions 1607, 1809, 21H2, 22H2), Windows 11 (Versions 24H2, 25H2, 26H1), and various Windows Server releases from 2012 to 2025 (including Server Core editions). Office-related products such as Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, and Microsoft Office for Android are also vulnerable.

The CVSS score of 7.8 places the vulnerability in the high severity range, while an EPSS score of 2% reflects a low‑to‑moderate likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog, indicating no publicly known exploits have been leveraged against it yet. Because it requires a local, authorized user, the attack surface is limited to environments where insider or compromised credentials exist, but the elevated privileges that can be obtained pose a significant risk to system confidentiality, integrity, and availability.