This vulnerability is a buffer over-read in the Windows GDI subsystem that can be exploited by an authorized local user, enabling elevation of privileges on the host machine. The flaw is identified as CWE-126. Successful exploitation allows the attacker to gain higher privileges, potentially enabling further malicious activity on the system.

The flaw impacts multiple Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and the corresponding ARM64 builds, as well as Windows Server 2012 through Server 2025, including their Server Core installations.

The vulnerability scores a CVSS of 7.8 and is not listed in the CISA KEV catalog. Given the lack of an EPSS score, the exploitation probability cannot be quantified, but the local nature and the requirement for authorization limit exposure. Management should treat the flaw as a high‑severity privilege‑escalation risk and ensure the update is installed promptly.