Numeric truncation errors in the Microsoft Graphics Component allow an attacker who already has an authorized local account to raise their privileges. The flaw occurs when the component mis‑processes numeric values, leading to incorrect bounds checks or memory manipulation that enables elevation. Because privilege escalation is confined to the local system, the attacker can gain higher privileges such as system or administrator rights, which can be leveraged to compromise other services or exfiltrate data.

Microsoft Windows 10 versions starting with 1607, including 1809, 21H2 and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, are impacted. All 32‑bit and 64‑bit builds that contain the vulnerable Graphics Component are affected; ARM64 builds of Windows 11 26H2 and related releases are also listed. Systems that run these operating systems without the latest cumulative updates will remain susceptible.

The CVSS vector is 7.8, indicating a high severity local privilege escalation. No EPSS score is available, which suggests that the public exploitation activity has not been quantified yet. The vulnerability is not in the CISA KEV catalog, so no current mass exploitation has been confirmed. The likely attack path requires an authenticated user to trigger the graphics component, for example by executing code or opening a crafted graphic payload locally. While no documented exploit exists at this time, the high impact and local nature make the flaw a strong candidate for targeted attacks.