Memory disclosure via mishandled GDI object addresses

Information disclosure in Microsoft Windows GDI allows local users to retrieve process memory by running a crafted application. GDI mishandles memory addresses while processing in-memory graphics objects, returning memory contents that should remain inaccessible. Exploitation requires local logon and application execution; the disclosure alone does not execute code but can support a separate exploit chain.