EUVD-2026-100363
GHSA-wh63-4w26-4m3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access
-
DeliveryInvoke vulnerable Graphics Component path
-
ExploitGroom heap and trigger overflow
-
ExecutionCorrupt heap metadata/objects
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already possess authenticated low-privileged local access to the target Windows host (AV:L, PR:L) and the ability to execute code that reaches the vulnerable Microsoft Graphics Component rendering/parsing path; no user interaction is needed (UI:N). Exploitation is materially limited by high attack complexity (AC:H), which indicates a race condition or precise heap-layout/grooming requirement that makes success non-deterministic and unreliable. There is no remote or unauthenticated path - the flaw cannot be triggered from the network and is only useful as a local privilege-escalation primitive after an initial foothold. |
| Impact | This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 7.0, HIGH) in the Microsoft Graphics Component, with CVSS metrics AV:L (local attack vector), AC:H (high attack complexity), PR:L (already-authenticated low-privileged attacker), UI:N, and full C:H/I:H/A:H impact on an unchanged scope. The signals are consistent and point to a post-compromise/privilege-escalation risk rather than a remote entry point: an attacker must already have a foothold with low privileges on the host. AC:H is significant - it typically implies a race condition or non-deterministic heap state that lowers reliability and realistic exploitability. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or available exploit code; the only reference is the Microsoft MSRC advisory. Net: this is a genuine but second-stage risk - valuable to attackers chaining local EoP after initial access (a common pattern for Windows graphics/kernel bugs), but not a drop-everything internet-facing emergency. The high AC and absence of exploitation signals argue against mass exploitation; prioritize patching on multi-user or exposed endpoints where untrusted code may run. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing or a compromised standard user account) invokes the vulnerable Microsoft Graphics Component code path to trigger a heap-based buffer overflow, corrupting heap memory to run code at a higher privilege level. Because attack complexity is high (likely a timing/heap-grooming dependency) and no public POC is identified at time of analysis, reliable exploitation requires significant skill and may not succeed on every attempt. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Microsoft Graphics Component lets an attacker who already holds authenticated, low-privileged code execution on a Windows host trigger a heap-based buffer overflow and gain full control over confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected machine. The flaw is exploitable only from the local attack vector (AV:L) by an authenticated low-privileged principal (PR:L) with no user interaction required (UI:N), and the high attack complexity (AC:H) means success depends on winning a race or precisely grooming the heap layout, making exploitation non-deterministic rather than reliable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing), so it is primarily a post-compromise escalation primitive rather than a remote entry point.
RemediationAI
The primary fix is to apply the Microsoft security update published through the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102209; no exact fixed build number is provided in the available data, so administrators should identify the applicable Knowledge Base article and target build from that advisory and deploy it via Windows Update, WSUS, or their patch-management pipeline as a priority for endpoints and multi-session/RDP hosts where untrusted users can execute code. Because the vulnerability requires an already-authenticated local foothold, the most effective compensating control prior to patching is to shrink the population of low-privileged users who can execute arbitrary code on the machine - enforce least privilege, remove unnecessary local logon rights, and restrict interactive access for non-administrative accounts. Application allowlisting via WDAC or AppLocker can prevent untrusted binaries from reaching the vulnerable parsing path, at the trade-off of administrative overhead and potential blocking of legitimate line-of-business applications that must be allowlisted explicitly. Enabling Windows Exploit Protection mitigations such as Heap Termination on Corruption, Control Flow Guard, and forced ASLR raises the reliability bar for heap-overflow exploitation but can cause compatibility issues with some third-party applications and should be piloted before broad rollout. Restricting who can supply image, font, or metafile content to privileged processes on shared hosts reduces the attack surface, though it is not a substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in the Microsoft Graphics Component, the Windows subsystem responsible for rendering and parsing graphical content such as images, metafiles, fonts, and drawing primitives. A heap overflow of this class occurs when a length, count, or dimensions field supplied through a graphics object is trusted without adequate validation, so a parsing or rendering routine writes past the bounds of a heap-allocated buffer. Because the affected code runs in privileged graphics-related contexts, a successful corruption of adjacent heap metadata or objects can be converted into code execution at a higher integrity level than the caller, which is why the CVSS impact metrics are fully C:H/I:H/A:H with scope unchanged (S:U). The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N places the flaw firmly in the local elevation-of-privilege category: the attacker must already be able to run code on the target, but no user interaction or network reachability is required. The AC:H rating signals that reliable exploitation demands either a narrow timing window (race condition) or precise heap-layout grooming, and that failure typically results in a crash rather than a controlled exploit. The root cause class is memory-safety related; the authoritative technical detail is published by Microsoft in the MSRC Update Guide advisory for this CVE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring an existing low-privileged account (PR:L, AV:L); heap overflow with race/grooming dependency justifies AC:H; successful elevation yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation flaw in the Microsoft Graphics Component (CVE-2026-102209) affects Windows endpoints and servers, allowing an attacker who already has a foothold on a machine to elevate to full system control. Because exploitation requires an existing authenticated low-privileged presence, leadership should treat this as a post-compromise escalation risk that amplifies the damage of any initial intrusion rather than as a remote entry point. No vendor patch is currently available, so residual exposure will persist until Microsoft releases a fix and organizations complete deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce least privilege and remove unnecessary local administrator rights; deploy application allowlisting and block untrusted executables; enable and tune EDR/behavioral detections for suspicious graphics-subsystem activity and token elevation; keep Windows exploit protection and heap mitigations enabled; segment and monitor privileged accounts with just-in-time administration; and prioritize detection of post-exploitation persistence and credential access attempts, since exploitation requires an existing authenticated low-privileged foothold.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB