What is the CVSS score of CVE-2026-32221?

CVE-2026-32221 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-32221?

CVE-2026-32221 is a local privilege escalation vulnerability in Microsoft's Graphics Component affecting Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025, allowing unauthenticated…. A patch is available.

How to fix or mitigate CVE-2026-32221?

Within 24 hours: Identify and inventory all Windows 11 (24H2/25H2/26H1) and Server 2025 systems in your environment using endpoint management tools; confirm patch availability from Microsoft Security Updates. Within 7 days: Deploy the available Microsoft Graphics Component security patch across all affected systems, prioritizing servers and workstations with administrative users or sensitive data access; test patches in non-production environments first. Within 30 days: Validate 100% patching compliance across all in-scope systems; conduct audit of recent endpoint compromise incidents to assess if this vulnerability was exploited as post-compromise escalation vector.

Microsoft CVE-2026-32221

EUVD-2026-22609 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-14 microsoft

GHSA-qm5p-p76j-g82x

Heap Overflow Buffer Overflow Microsoft

8.4

CVSS 3.1 · NVD

Temporal: 7.3

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.3 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:22 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22609

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 8.4

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

AnalysisAI

Local privilege escalation in Microsoft Graphics Component across Windows 11 24H2/25H2/26H1 and Server 2025 enables unauthenticated local attackers to execute arbitrary code with high integrity via heap-based buffer overflow exploitation. CVSS 8.4 (High) reflects low attack complexity and no user interaction requirement, though local access is necessary. EPSS data unavailable; no CISA KEV listing or public exploit identified at time of analysis, but the low complexity (AC:L) and no-auth requirement (PR:N) make this highly attractive for post-compromise escalation.

Technical ContextAI

This vulnerability affects the Microsoft Graphics Component (GDI+/DirectWrite subsystem layer) responsible for rendering graphics, fonts, and images across Windows platforms. The heap-based buffer overflow (CWE-122) occurs when the graphics component fails to properly validate bounds during memory allocation or manipulation operations on the heap. Unlike stack overflows, heap corruption allows attackers to overwrite function pointers, vtables, or critical data structures in dynamically allocated memory, enabling reliable code execution. Affected products include Windows 11 versions 24H2 (builds 10.0.26100.0 through 10.0.26100.32689), 25H2 (builds 10.0.26200.0 through 10.0.26200.8245), 26H1 (builds 10.0.28000.0 through 10.0.28000.1835), and Windows Server 2025 including Server Core installations (builds 10.0.26100.0 through 10.0.26100.32689). The graphics component processes untrusted input from files, network streams, or inter-process communications, making it a common attack surface.

RemediationAI

Apply vendor-released patches immediately through Windows Update or Microsoft Update Catalog. Fixed versions are Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32221 for deployment guidance and known issues. No effective workarounds exist for heap-based memory corruption vulnerabilities; patching is the only reliable mitigation. Prioritize deployment on systems with multiple local users, exposed RDP/terminal services, or where local code execution has occurred. Verify patch installation via Windows Update history or WMIC command 'wmic qfe list' confirming KB installation.