Microsoft Graphics Component CVE-2026-58609

Exploitation requires local delivery of specially crafted graphics content to a vulnerable Windows host AND user interaction (CVSS UI:R) - the victim must open, preview, or otherwise render the malicious file for the out-of-bounds read in the Microsoft Graphics Component to trigger; it cannot be launched remotely without that user action. No pre-existing privileges or authentication are required of the attacker (PR:N). The primary limiting factors are the mandatory user interaction and the local attack vector (AV:L), which prevent unattended, network-driven mass exploitation; the target must also be running an affected, unpatched Windows 10/11 or Windows Server 2012-2025 build. There is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, further limiting real-world risk.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a base score of 7.8 (High). The signals are internally consistent for a client-side file-parsing bug: local attack vector (AV:L) with required user interaction (UI:R) means the victim must open malicious content, which meaningfully limits mass exploitation compared to a remote, no-interaction flaw. PR:N indicates no prior privileges are needed once the user acts. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or imminent widespread exploitation. Note a signal tension worth flagging: the CWE (out-of-bounds read) and the 'Information Disclosure' tag point toward memory leakage, whereas the description asserts code execution - verify the true impact against the Microsoft advisory, as this affects whether the practical outcome is data disclosure or full RCE. Given the ubiquity of the Windows graphics stack, this warrants prompt patching in the normal cycle, but the UI:R and AV:L constraints keep it below drop-everything urgency absent exploitation evidence.

An attacker crafts a malicious file or web/document resource containing malformed graphics data and delivers it via email, a download, or a shared document. When the targeted user opens or previews the content on an unpatched Windows system, the Microsoft Graphics Component reads out of bounds while parsing it, allowing the attacker to disclose memory or, per Microsoft, execute code in the user's context. No public POC is referenced in the available data.