An out-of-bounds read occurs within the Microsoft Graphics Component, allowing an attacker who already has authorized access to read memory beyond intended bounds and elevate privileges on the local system. This flaw is classified as CWE-125, which can result in unauthorized access, code execution, or other integrity and confidentiality violations by granting the attacker higher privilege levels.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2019, 2022, 2025 including Server Core installations.

The CVSS score of 7.8 indicates a high severity. The EPSS figure is not available, but the vulnerability is not listed in the CISA KEV catalog, so no publicly disclosed exploits are known. The likely attack vector is a local attacker with some level of authorized access who can trigger the Graphics Component, such as through a desktop application or user-supplied content that interacts with the graphics subsystem.