What is the CVSS score of CVE-2026-44803?

CVE-2026-44803 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Windows Win32K are affected by CVE-2026-44803?

A local privilege escalation vulnerability (CVSS 7.8) in Windows Win32K graphics subsystem allows code-executing attackers to elevate from user to system level, creating a post-exploitation pathway…. A patch is available.

How to fix or mitigate CVE-2026-44803?

Within 24 hours: Inventory all Windows systems and assess exposure to local code execution vectors (script execution, macro-enabled documents, third-party software vulnerabilities). Within 7 days: Implement local access restrictions (disable Remote Desktop unless essential, enforce application whitelisting, harden UAC settings) and deploy monitoring for Win32K privilege escalation indicators. Within 30 days: Continuously monitor Microsoft Security Response Center for patch release; prepare patching deployment plan and test in non-production environment immediately upon availability.

Windows Win32K CVE-2026-44803

EUVD-2026-35758 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-09 secure@microsoft.com

GHSA-9978-hjf6-vg85

Microsoft Integer Overflow Buffer Overflow Excel Powerpoint Word Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:48 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in the Windows Win32K GRFX (graphics) subsystem allows an unauthorized attacker with the ability to run code locally to escalate privileges through an integer overflow. The flaw was reported by Microsoft (MSRC) and carries a CVSS 7.8, but requires user interaction (UI:R) and local access (AV:L), and no public exploit identified at time of analysis.

Technical ContextAI

Win32K is the kernel-mode component of Windows that implements the windowing system, USER and GDI services; the GRFX (graphics) sub-component handles font, glyph, bitmap and other graphics primitives. CWE-190 (Integer Overflow or Wraparound) indicates that an arithmetic calculation - likely a size, offset, or length used during graphics object processing - wraps past its maximum representable value, producing an undersized allocation or out-of-bounds index that the surrounding code subsequently trusts. Because Win32K runs in the kernel, a successful overflow that corrupts memory can be leveraged into kernel-mode code execution, which is consistent with the 'Microsoft' / 'Buffer Overflow' / 'Integer Overflow' tags and the Confidentiality/Integrity/Availability = High CVSS impacts.

RemediationAI

Apply the Microsoft security update for CVE-2026-44803 from the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44803 - patch available per vendor advisory, though a specific fix build number was not provided in the input data and should be read directly from the advisory's 'Security Updates' table for each affected Windows SKU. Until patching, compensating controls should focus on reducing exposure of the Win32K GRFX path: restrict execution of untrusted binaries and documents on affected hosts via AppLocker/WDAC (side effect: may block legitimate user-installed tools), enable Win32k system call filtering / Win32k lockdown for processes that support it such as browser renderers (side effect: incompatible with some legacy graphics-heavy apps), and prevent low-privileged or guest accounts from running arbitrary code interactively (side effect: impacts shared workstation use cases). Standard endpoint detection on suspicious kernel exploit primitives (token-stealing, GDI object spraying) is also advisable as a detective control.