An out‑of‑bounds read flaw exists in the Windows Graphics Kernel that allows an attacker with local, authorized access to read memory beyond the intended bounds, potentially compromising system memory integrity and enabling code execution with higher privileges. The weakness is classified as CWE‑125 (Out‑of‑Bounds Read) and CWE‑190 (Integer Overflow or Wraparound). If exploited successfully, the attacker could bypass operating system security controls, gain administrative rights, and compromise the confidentiality, integrity, or availability of the affected machine or connected infrastructure.

This vulnerability affects a broad range of Microsoft operating systems, including Windows 10 releases from version 1607 through 22H2, Windows 11 releases from 23H2 through 26H2 (both x64 and ARM64), and multiple Windows Server editions such as 2012 (standard and R2, with Server Core), 2016, 2019, 2022, and 2025. The affected build list is extensive and spans both client and server environments, meaning any installation of these releases that has not been updated to the latest patch level is potentially vulnerable.

With a CVSS score of 7.8, the vulnerability is considered high risk. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is local; an attacker must already have physical or remote console access and sufficient permission to run privileged code. Once the vulnerability is triggered, the resulting privilege escalation can allow the attacker to run arbitrary code with kernel privileges, effectively compromising the entire host.