EUVD-2026-43771
GHSA-wx9m-v548-jq76
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing flaw needing a user to open crafted content, so AV:L and UI:R with PR:N; impact set to H per Microsoft's code-execution claim, though CWE-125 suggests disclosure may dominate.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in the Microsoft Graphics Component affects a broad range of supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025). An attacker who convinces a user to open a specially crafted file or content triggers an out-of-bounds read (CWE-125) that Microsoft rates as enabling code execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation requires local access plus user interaction, making it a standard patch-cycle priority rather than an emergency.
Technical ContextAI
The Microsoft Graphics Component is a core Windows subsystem responsible for parsing and rendering graphical content (fonts, images, and drawing primitives) consumed across the OS and by many applications. The root cause is CWE-125, an out-of-bounds read, where the parser reads memory beyond the bounds of an allocated buffer - typically because a length or offset field in attacker-supplied graphics data is not validated against the actual buffer size. While an out-of-bounds read most directly causes information disclosure (and Microsoft's own tags list 'Information Disclosure' and 'Buffer Overflow'), Microsoft's description states the flaw allows local code execution, implying the memory-safety error is leverageable beyond a simple read. The affected CPE set spans Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025 including Server Core installations, confirming the vulnerable code ships in the shared Windows graphics stack rather than an optional component.
RemediationAI
Apply the Microsoft security update for CVE-2026-58609 as the primary fix; a patch is available per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58609, which enumerates the specific patched build for each affected Windows client and server SKU (no single cross-product fix version is provided in the input, so consult the advisory for the exact KB/build matching your OS). Because exploitation requires a user to open crafted content, interim compensating controls include restricting or blocking untrusted files and email attachments that route through the Windows graphics/rendering stack, enforcing least privilege so a successful exploit runs in a low-privilege context, and using attack-surface-reduction rules and application allow-listing to limit which processes render untrusted graphics - with the trade-off that aggressive attachment or content blocking can disrupt legitimate document and image workflows. Prioritize patching internet-facing and multi-user hosts (RDP/session hosts, Server Core roles) where crafted content is most likely to reach a user.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today