A heap‑based buffer overflow exists in the Windows Win32K Graphics (GRFX) subsystem that can be triggered by an attacker who already has authorized access to the machine. The flaw allows the attacker to overwrite memory on the heap and elevate privileges locally, potentially granting full system control. The vulnerability is classified under CWE‑122.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, including both x86, x64, and ARM64 builds where applicable. All listed desktop and core installations are affected.

The CVSS score of 7.8 indicates high severity. The attack vector is local and requires the attacker to be authorized to execute code on the target. Because it is not remotely triggerable and is not listed in the CISA KEV catalog, the likelihood of exploitation in the wild is lower, but it remains a significant risk in environments where privileged users are compromised or where malware is already resident. EPSS data is not available.