A heap-based buffer overflow was identified in the Windows Win32K graphics subsystem, specifically within the GRFX component. The flaw allows an attacker who can execute code within the local system context to override ordinary memory boundaries and obtain elevated privileges. This vulnerability is classified as CWE-122, reflecting a classic buffer overflow that can compromise the integrity of the operating system and enable arbitrary code execution at a higher privilege level.

Affected systems include Microsoft Windows 10 build 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1. Server editions impacted are Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, covering both standard and core installations. The list spans many mainstream releases, meaning a broad user base could be exposed.

The CVSS score of 7.8 indicates a high risk severity, while the EPSS score is currently unavailable, and the vulnerability is not catalogued in the CISA KEV list. Because the flaw resides in a core component, an attacker who can run local code can trigger the overflow without needing network exposure. Exploitation requires local access to the system and successful execution of crafted input to the GRFX subsystem, after which privilege can be escalated from standard user to system level. Monitoring for anomalous privilege escalation behavior is advisable until the vulnerability is fully mitigated.