Executive brief
A security vulnerability exists in the Windows Win32K graphics component, which manages how applications interact with displays and input devices. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A race condition exists within the Windows Win32K - GRFX component due to improper synchronization when accessing shared resources. This vulnerability, which may lead to a Use-After-Free (UAF) condition (CWE-416), requires the attacker to have local access with low privileges. While the attack complexity is high due to the timing requirements of a race condition, a successful exploit allows for a complete loss of confidentiality, integrity, and availability by elevating the attacker's privileges to SYSTEM level. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows Not specified (Win32K component)
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Microsoft published the security update guide.