Windows DirectX CVE-2025-62463

Requires an authenticated local session with low privileges on an affected Windows host (Windows 10 21H2/22H2 x64, Windows 11 23H2/24H2/25H2, or Windows Server 2022/2022 23H2/2025) - the attacker must already be able to execute code locally to reach the vulnerable DirectX interface. No user interaction is required (UI:N). Exploitation is LIMITED by the local-only attack vector (AV:L): it cannot be triggered remotely, and impact is confined to denial of service (availability), with no confidentiality or integrity effect. DirectX is present by default on all these SKUs, so no special feature or non-default configuration is needed beyond local access.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) confirms local access and low privileges are required, with impact limited purely to availability (C:N/I:N) - no data disclosure or integrity loss. The 6.5 base score is inflated by the S:C (scope-changed) flag; without it a local DoS would score lower. EPSS is 0.46% (38th percentile), consistent with a local-only DoS that offers little attacker value - you must already have code execution on the box to trigger it. There is no CISA KEV listing and no public exploit identified, so this is a high-CVSS-relative-to-real-risk case rather than an urgent threat. Signals are consistent (low EPSS, no KEV, local vector, availability-only impact all point the same direction). The one point worth verifying with Microsoft is the S:C claim: scope change for a local DirectX null-pointer DoS typically implies a crash affecting the kernel/graphics subsystem beyond the calling process, but the terse MSRC description does not detail this.

A local, low-privileged user (or malware already running on the host) invokes the vulnerable Windows DirectX code path with crafted input that dereferences a null pointer, crashing the graphics subsystem or triggering a bugcheck and denying service to the system. No public exploit code has been identified, and no user interaction or elevated privileges are needed beyond an authenticated local session.