A heap-based buffer overflow exists in the Windows Win32K graphics subsystem that permits an authorized local user to gain elevated privileges. The flaw is a classic buffer overflow (CWE‑122) that can be triggered by sending specially crafted data to the kernel, allowing the attacker to execute code at higher privilege levels. This leads to local privilege escalation, potentially exposing system secrets and enabling further attacks.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 24H2, 25H2, and 26H1; Microsoft Windows Server 2016, 2019, 2022, and 2025 (both standard and Server Core installations).

The CVSS score of 7.8 indicates high severity, while an EPSS score of 2% shows that exploitation is low but not negligible. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known active exploitation at this time. The likely attack vector is local, requiring a user with some level of authorization to run the exploit code. Once executed, the attacker can elevate privileges system‑wide, potentially gaining full administrative control, but only after bypassing the standard user sandbox.