This vulnerability, described as an out‑of‑bounds write in the Windows GDI subsystem, permits an attacker without local privileges to execute arbitrary code on a target system over a network connection. The flaw arises from improper bounds checking when GDI writes to memory buffers, which fits CWE‑787. Successful exploitation would compromise confidentiality, integrity, and availability of the affected machine, enabling full control.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server 2012 R2, 2016, 2019, 2022, and 2025, including core installations, are impacted by this flaw.

The flaw receives a CVSS score of 8.8, indicating high severity. EPSS data is not presently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a known widespread exploit. However, the description indicates that the attacker can trigger the out‑of‑bounds write remotely, so the attack vector is inferred to be network‑based. Given the high severity and the potential for remote code execution, the risk to unpatched systems remains significant, and exploitation is plausible in environments that expose GDI services to an attacker without containment.