What is the CVSS score of CVE-2026-21235?

CVE-2026-21235 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Industrial are affected by CVE-2026-21235?

CVE-2026-21235 is a privilege escalation vulnerability in Microsoft Graphics Component that could allow authorized users to gain elevated system access on affected workstations.. A patch is available.

How to fix or mitigate CVE-2026-21235?

Within 24 hours: Inventory all systems running affected Microsoft Graphics Component versions and isolate critical assets from general user access. Within 7 days: Implement application whitelisting and restrict local administrative access; evaluate temporary disabling of affected graphics features if operationally feasible. Within 30 days: Monitor Microsoft security advisories for patch availability; conduct risk assessment for each affected system and develop patching strategy upon vendor release.

Industrial CVE-2026-21235

HIGH

Use After Free (CWE-416)

2026-02-10 secure@microsoft.com

Microsoft Industrial Use After Free Windows Server 2019 Windows Server 2012 Windows 10 21h2 Windows 10 1809 Windows 10 1607 Windows Server 2016 Windows 11 23h2 Windows 10 22h2 Windows Server 2022

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.3

DescriptionCVE.org

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Microsoft Graphics Component via use-after-free memory corruption affects Windows Server 2019 and 2012, allowing authenticated local attackers to gain elevated system privileges with user interaction. The vulnerability poses a significant risk in industrial environments where Windows Server hosts critical infrastructure. No patch is currently available for this high-severity issue.

Technical ContextAI

Classified as CWE-416 (Use After Free). Affects the Microsoft Graphics component of Windows 10 1607. Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.