EUVD-2026-22609
GHSA-qm5p-p76j-g82x
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
6DescriptionCVE.org
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
AnalysisAI
Local privilege escalation in Microsoft Graphics Component across Windows 11 24H2/25H2/26H1 and Server 2025 enables unauthenticated local attackers to execute arbitrary code with high integrity via heap-based buffer overflow exploitation. CVSS 8.4 (High) reflects low attack complexity and no user interaction requirement, though local access is necessary. EPSS data unavailable; no CISA KEV listing or public exploit identified at time of analysis, but the low complexity (AC:L) and no-auth requirement (PR:N) make this highly attractive for post-compromise escalation.
Technical ContextAI
This vulnerability affects the Microsoft Graphics Component (GDI+/DirectWrite subsystem layer) responsible for rendering graphics, fonts, and images across Windows platforms. The heap-based buffer overflow (CWE-122) occurs when the graphics component fails to properly validate bounds during memory allocation or manipulation operations on the heap. Unlike stack overflows, heap corruption allows attackers to overwrite function pointers, vtables, or critical data structures in dynamically allocated memory, enabling reliable code execution. Affected products include Windows 11 versions 24H2 (builds 10.0.26100.0 through 10.0.26100.32689), 25H2 (builds 10.0.26200.0 through 10.0.26200.8245), 26H1 (builds 10.0.28000.0 through 10.0.28000.1835), and Windows Server 2025 including Server Core installations (builds 10.0.26100.0 through 10.0.26100.32689). The graphics component processes untrusted input from files, network streams, or inter-process communications, making it a common attack surface.
RemediationAI
Apply vendor-released patches immediately through Windows Update or Microsoft Update Catalog. Fixed versions are Windows 11 24H2 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Consult the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32221 for deployment guidance and known issues. No effective workarounds exist for heap-based memory corruption vulnerabilities; patching is the only reliable mitigation. Prioritize deployment on systems with multiple local users, exposed RDP/terminal services, or where local code execution has occurred. Verify patch installation via Windows Update history or WMIC command 'wmic qfe list' confirming KB installation.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
MSHTML Framework contains a protection mechanism failure (CVE-2026-21513, CVSS 8.8) allowing remote attackers to bypass
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today