EUVD-2026-35737
GHSA-w2x7-5hqr-63mv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Microsoft Graphics Component allows an authenticated low-privileged attacker to gain elevated rights via a use-after-free memory corruption flaw (CWE-416). The issue carries a CVSS 7.8 (High) rating with full confidentiality, integrity, and availability impact on the affected host. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Technical ContextAI
The Microsoft Graphics Component is a shared Windows subsystem responsible for rendering, font handling, and image/graphics object management used by GDI, DirectX, and related kernel/user-mode graphics paths. CWE-416 (Use After Free) indicates that a graphics object's memory is freed while a dangling reference remains reachable; subsequent dereference of that pointer allows an attacker who controls the freed slot's contents to corrupt structures and hijack execution flow. Because graphics objects are commonly handled by privileged components on Windows, controlled reuse of the freed allocation is a classic primitive for local elevation to SYSTEM or higher integrity.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42986 as soon as your patch cycle permits, prioritizing multi-user systems (RDP/Citrix hosts, shared workstations, developer build servers) where low-privileged local accounts can directly stage the exploit. No specific fix version string was supplied in the input, so confirm the exact KB and Windows build number directly from MSRC before deployment. Until patched, reduce blast radius by enforcing least-privilege on interactive logon accounts, removing local-logon rights from service accounts where feasible, enabling Microsoft Defender Exploit Guard / HVCI to constrain kernel exploitation primitives, and restricting interactive sessions on sensitive servers - note that HVCI can break older drivers and disabling interactive logon can break legitimate admin workflows.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today