The vulnerability is a heap‑based buffer overflow in the Windows Graphics Kernel. When triggered, it lets an attacker with local access write past the bounds of a heap buffer and overwrite control data, giving the attacker higher privilege level. This flaw is a classic example of uncontrolled write and can compromise the entire system’s integrity.

Affected systems include Microsoft Windows 11 Version 24H2, 25H2, and 26H2 for arm64‑based systems, as well as Microsoft Windows Server 2025 and the Server Core installation. All listed versions are currently vulnerable to the overflow.

The CVSS base score is 7, indicating a moderate to high severity. Because the flaw requires an authorized local user to trigger the overflow, the attack surface is limited to a compromised user account and may be mitigated by role isolation. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog.