Executive brief
A security vulnerability exists in the Windows Win32K graphics component, which is responsible for managing window displays and graphics output. An attacker who successfully exploits this flaw could gain full control over the affected computer, potentially leading to the theft of sensitive data or the installation of malicious software. To carry out this attack, a user would typically need to be tricked into running a malicious application or opening a specially crafted file.
Technical details
This vulnerability is classified as an integer overflow or wraparound (CWE-190) within the Win32K - GRFX component of the Windows kernel-mode driver. The flaw is triggered when the system incorrectly handles memory allocation or arithmetic operations related to graphics processing. An attacker can exploit this by running a specially crafted application on the local system, though the CVSS vector indicates that user interaction is required (UI:R). Successful exploitation allows for local code execution with high privileges, compromising the confidentiality, integrity, and availability of the system. Microsoft has released information regarding this via their Security Update Guide.
Affected products
- Microsoft Windows Not specified
Timeline
- 2026-06-09: disclosed: Initial disclosure by Microsoft and NVD publication.
- 2026-06-09: advisory: Microsoft MSRC advisory published.