The vulnerability is a stack‑based buffer overflow in the Windows GDI component, identified as CWE‑121. An attacker who can trigger the overflow can force a target system to drop connections or otherwise become unavailable, without compromising confidentiality or integrity. The flaw is triggered by malformed GDI data processed by the system.

The affected products are Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1, including ARM64 and x64 variants) and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both in standard and server‑core configurations.

The CVSS score of 7.5 places the flaw in the high‑severity range. The EPSS score of 1% indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploitation at the time of analysis. The attack vector is inferred as remote, network‑based, because the description states that an attacker can deny service over a network. The risk to a deployed system is high if the vulnerable GDI functionality remains exposed, especially in environments that accept remote drawing or imaging data.