Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Log in with authorized credentials
  2. Exploit
    Trigger use-after-free in Graphics Component
  3. Execution
    Elevate privileges to SYSTEM
  4. Impact
    Execute arbitrary code with elevated rights

Vulnerability Assessment

Weakness
CWE
CWE-416
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Authorized local user account required. User interaction needed to trigger Graphics Component vulnerability. Windows system with vulnerable Graphics Component installed.
Impact

CVSS 7.3 (HIGH). Attack vector: Local. Complexity: Low. Privileges required: Low. User interaction: Required. Exploitable via local access.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Privilege escalation in Microsoft Graphics Component via use-after-free memory corruption affects Windows Server 2019 and 2012, allowing authenticated local attackers to gain elevated system privileges with user interaction. The vulnerability poses a significant risk in industrial environments where Windows Server hosts critical infrastructure. No patch is currently available for this high-severity issue.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 22:02 CVSS 7.3

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. [CVSS 7.3 HIGH]

RemediationAI

Monitor vendor advisories for a patch.

Affected Packages

microsoft windows_10_version_1607_10_0_14393_8868 fix: Windows 10 Version 1607 for 32-bit Systems 10.0.14393.8868, Windows 10 Version 1607 for x64-based Systems 10.0.14393.8868
microsoft windows_10_version_1809_10_0_17763_8389 fix: Windows 10 Version 1809 for 32-bit Systems 10.0.17763.8389, Windows 10 Version 1809 for x64-based Systems 10.0.17763.8389
microsoft windows_10_version_21h2_10_0_19044_6937 fix: Windows 10 Version 21H2 for 32-bit Systems 10.0.19044.6937, Windows 10 Version 21H2 for ARM64-based Systems 10.0.19044.6937, Windows 10 Version 21H2 for x64-based Systems 10.0.19044.6937
microsoft windows_10_version_22h2_10_0_19045_6937 fix: Windows 10 Version 22H2 for 32-bit Systems 10.0.19045.6937, Windows 10 Version 22H2 for ARM64-based Systems 10.0.19045.6937, Windows 10 Version 22H2 for x64-based Systems 10.0.19045.6937
microsoft windows_11_version_23h2_10_0_22631_6649 fix: Windows 11 Version 23H2 for ARM64-based Systems 10.0.22631.6649, Windows 11 Version 23H2 for x64-based Systems 10.0.22631.6649
microsoft windows_11_version_26h1_10_0_28000_1575 fix: Windows 11 Version 26H1 for ARM64-based Systems 10.0.28000.1575, Windows 11 version 26H1 for x64-based Systems 10.0.28000.1575
microsoft windows_server_2012_6_2_9200_25923 fix: Windows Server 2012 6.2.9200.25923, Windows Server 2012 (Server Core installation) 6.2.9200.25923
microsoft windows_server_2012_r2_6_3_9600_23022 fix: Windows Server 2012 R2 6.3.9600.23022, Windows Server 2012 R2 (Server Core installation) 6.3.9600.23022
microsoft windows_server_2016_10_0_14393_8868 fix: Windows Server 2016 10.0.14393.8868, Windows Server 2016 (Server Core installation) 10.0.14393.8868
microsoft windows_server_2019_10_0_17763_8389 fix: Windows Server 2019 10.0.17763.8389, Windows Server 2019 (Server Core installation) 10.0.17763.8389
microsoft windows_server_2022_10_0_20348_4773 fix: Windows Server 2022 10.0.20348.4773, Windows Server 2022 (Server Core installation) 10.0.20348.4773

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 11 packages in microsoft

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-416 (Use After Free). Affects the Microsoft Graphics component of Windows 10 1607. Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Know when Industrial gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.3 HIGH
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Zero Day Initiative Advisories

ZDI-26-081 Microsoft Windows win32kfull Use-After-Free Local Privilege Escalation Vulnerability Feb 2026

Executive ViewAI

Why It Matters

CVE-2026-21235 is a privilege escalation vulnerability in Microsoft Graphics Component that could allow authorized users to gain elevated system access on affected workstations. Without an available patch, this represents an active risk to organizations running vulnerable Microsoft systems that require immediate mitigation planning.

Business Impact: High
Compensating Controls

Restrict user account privileges to prevent unauthorized elevation; implement application whitelisting to limit execution of potentially exploitable graphics processes; disable unnecessary graphics acceleration features where operationally viable; enforce multi-factor authentication for privileged accounts; increase monitoring and auditing of privilege escalation attempts on affected systems; apply principle of least privilege across user accounts and administrator access.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Affected Products (CPE)CVE.org

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*

More in Industrial

View all
CVE-2025-63624 CRITICAL POC
9.8 Feb 03

Kede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
CVE-2026-24857 CRITICAL POC
9.8 Jan 28

bulk_extractor digital forensics tool starting from version 1.4 has a heap buffer overflow in its embedded unrar code th
CVE-2026-23519 CRITICAL POC
9.8 Jan 15

RustCrypto CMOV before 0.4.4 emits non-constant-time assembly on ARM Cortex-M0/M0+/M1 targets. Cryptographic operations

CVE-2021-47881 HIGH POC
8.4 Jan 23

dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to over
CVE-2026-22850 HIGH POC
8.3 Jan 19

SQL injection in Koko Analytics for WordPress prior to version 2.1.3 allows unauthenticated attackers to inject maliciou
CVE-2026-22700 HIGH POC
7.5 Jan 10

RustCrypto's SM2 elliptic curve implementation in versions 0.14.0-pre.0 and 0.14.0-rc.0 is vulnerable to denial-of-servi
CVE-2026-26025 HIGH POC
7.5 Feb 24

free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allo
CVE-2026-26024 HIGH POC
7.5 Feb 24

free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 inte
CVE-2026-25501 HIGH POC
7.5 Feb 24

free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the PFCP interfac
CVE-2019-25291 HIGH POC
7.5 Jan 08

INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that ca
CVE-2026-22689 MEDIUM POC
6.5 Jan 10

Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email c
CVE-2025-64075 CRITICAL
10.0 Feb 11

Authentication bypass via path traversal in ZBT WE2001 router's check_token function. EPSS 0.69% — crafted requests bypa

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2012-4969 HIGH POC
8.1

References

Advisories & patches
ADVISORY https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21235

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy