Windows Text Shaping CVE-2026-102210

Exploitation requires that the target process untrusted text or font data through the Windows Text Shaping (text-shaping/DirectWrite font-rendering) component - for example by opening a crafted document, rendering attacker-supplied web/text content, or via a service that performs text layout on remote input. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are claimed to be required, implying exploitation against default Windows configurations wherever untrusted text reaches the vulnerable code path. The practical limiting factors not captured by the vector are the need for a reachable code path that feeds attacker-controlled data into text shaping and the reliability of defeating standard Windows heap/exploit mitigations (ASLR, CFG, heap randomization), which can make real-world code execution harder than the AC:L rating suggests.

This is a genuinely high-priority vulnerability that should be patched urgently. The CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated code execution with full confidentiality, integrity, and availability impact - the maximal profile short of a scope change. The affected component (Windows Text Shaping) is a core OS font/text-rendering subsystem present on effectively all Windows installations, so the real-world attack surface is very large. However, several exploitation signals are MISSING from the provided data: no EPSS probability was supplied, there is no CISA KEV listing, and no proof-of-concept is referenced, so there is 'no public exploit identified at time of analysis.' The sole reference is the Microsoft MSRC advisory; no NVD-enriched detail or independent confirmation of in-the-wild activity is present. Treat the severity as confirmed by the vendor-supplied CVSS but treat exploitation likelihood as unquantified - heap overflows in text-shaping/font parsing are historically exploitable but often require heap-grooming and may be mitigated by modern Windows exploit mitigations (ASLR, CFG), which can raise practical attack complexity beyond the AC:L rating. Net: prioritize patching due to the ubiquity and unauthenticated network vector, but note that the absence of EPSS/KEV/POC means widespread active exploitation is not currently evidenced.

An attacker delivers specially crafted text or font data to a victim system that processes it through the Windows Text Shaping component - for example via a document, web content, or a network-facing service that renders text - triggering a heap-based buffer overflow. Because the CVSS vector is AV:N/PR:N/UI:N, no authentication or user interaction is required, allowing the attacker to corrupt heap memory and execute arbitrary code in the context of the processing component. No public proof-of-concept is referenced in the available data.