The EPSS score of 0.00396 tells you more about this vulnerability than the CVSS 5.5 rating. GDI+ uninitialized resource disclosure has a documented recurrence pattern — CVE-2014-1815, CVE-2013-0073, and now this — where Microsoft patches the specific call path without changing the underlying allocator behavior. That pattern is the analytical signal that matters, because it means each CVE is not a discrete event but a data point in an accumulating technique library. Attackers don't need to weaponize any single disclosure — they need one to exist in the pool of available primitives for kernel pool massage or kASLR defeat.
The "authorized local attacker" qualifier in the CVSS calculation functions as a severity discount that has historically proven wrong for GDI+ lineage. Information disclosures in this component have repeatedly surfaced years later as preconditions in privilege-escalation chains that were not captured at disclosure time. The standalone CVSS measures technical severity correctly; it measures systemic risk incorrectly.
Prioritize patching based on deployment topology, not score. Document rendering servers, VDI environments, and any endpoint processing untracked SVG or metafile content face elevated blast radius if this disclosure chains with a separate privilege-escalation path. Track whether subsequent GDI+ patches follow the call-path-sanitization pattern or represent genuine allocator hygiene changes — the former signals continued variant debt, the latter signals structural remediation. For mature security programs, the question isn't whether to patch — it's whether your vulnerability prioritization model accounts for disclosures that function as technique library components rather than isolated exploitation events.