A use‑after‑free flaw in the Windows Graphics Kernel can expose data that resides in memory to an authorized local user. The vulnerability allows the attacker to read kernel memory contents, potentially leaking confidential information about the system or other running applications. This is an example of a CWE‑416 weakness where an object is accessed after it has been freed.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (23H2 through 26H2, including ARM64‑based systems), and Microsoft Windows Server from 2012 through 2025 (including Server Core variants). All these operating systems contain the affected graphics kernel component that can be triggered by local applications or drivers.

The CVSS score of 4.7 indicates a moderate severity for this local information‑disclosure vulnerability. The EPSS score is not available, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in CISA’s KEV catalog. The attack likely requires an authorized user to run a malicious or compromised application that interacts with the graphics subsystem. Since the issue is local, remote exploitation is not supported by the information provided, but any user with sufficient privileges to execute code can potentially trigger the flaw.