Executive brief
A security vulnerability exists in the Windows kernel component responsible for graphics and window management. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to install programs, view or delete sensitive data, or create new accounts with full user rights.
Technical details
This vulnerability is a use-after-free (UAF) located within the Win32K GRFX component of the Windows kernel. While initially reported as a type confusion (CWE-843) in the ICOMP component, updated advisory data confirms it as a UAF in GRFX. An attacker with low-privileged local access can trigger the flaw without user interaction to execute arbitrary code in kernel mode. Successful exploitation results in a complete loss of confidentiality, integrity, and availability, typically leading to local privilege escalation (LPE) to SYSTEM. Microsoft has released security updates to address this issue across supported versions of Windows and Windows Server.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 23H2, 24H2, 25H2, 26H1
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 23H2
- Microsoft Windows Server 2025 All versions
Timeline
- 2026-05-12: disclosed: Initial disclosure by Microsoft
- 2026-05-12: advisory: NVD published the CVE record
- 2026-06-01: other: Description updated from type confusion to use-after-free