A critical race condition in the Windows Win32K GRFX component allows an authenticated local attacker to achieve code execution, posing a significant risk to host integrity.

This vulnerability involves a race condition (CWE-362) and a use after free (CWE-416) within the Windows Win32K GRFX subsystem. An attacker with local authenticated access can exploit these memory management flaws to achieve local code execution.

The vulnerability carries a CVSS score of 7.8, reflecting its potential for total system compromise. While local access is required, the ability for an attacker to escalate privileges or execute code at the kernel level can lead to complete loss of confidentiality, integrity, and availability for the affected host. This presents a severe risk to organizational systems where users have local access or where malicious software could be executed within a user context.

Immediate Action: Apply the September 2025 security updates provided by Microsoft for the specific Windows versions identified above.

Proactive Monitoring: Monitor system logs for unusual crashes or unexpected behavior in the Win32K subsystem, which may indicate attempted exploitation.

Compensating Controls: Ensure endpoint detection and response tools are active to identify and block unauthorized local process execution or anomalous system calls.

Public Exploit Available: Unknown

Given the potential for full system compromise via kernel-level code execution, administrators should prioritize the deployment of the vendor-provided patches. While the requirement for local access mitigates the immediate threat from remote actors, the severity of the impact necessitates prompt remediation to prevent privilege escalation by malicious insiders or secondary payloads from malware.