Windows Graphics Component CVE-2026-69326

Exploitation requires the victim to open or render attacker-controlled content containing a malformed font processed by the Windows Graphics/Fonts subsystem - e.g., a document, email, or web page that embeds the crafted font. The limiting factor is the mandatory user interaction (CVSS UI:R): there is no server-side or unattended trigger, so the attacker must socially engineer the victim into opening the content. No authentication is required (PR:N) and no special non-default configuration is indicated; the affected font-parsing code path is present in default installations of all listed Windows client and server builds. Code executes in the context of the user who opens the content, so running as a low-privilege/standard user limits the immediate blast radius.

Signals are consistent in severity but divergent on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated code-execution flaw whose only gating factor is required user interaction (UI:R) - the hallmark of a font-parsing bug triggered when a victim opens attacker-supplied content. CISA SSVC, however, tempers this: Exploitation is rated 'none' (no observed or public exploitation), Automatable 'no' (the UI:R requirement prevents scripted mass-exploitation/wormability), while Technical Impact is 'total,' matching the C:H/I:H/A:H full-compromise profile. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis. Net: this is a genuinely high-impact, high-priority patch for any Windows estate because of total technical impact and the enormous installed base, but it is NOT currently an emergency drive-by threat - exploitation requires luring a user to open malicious content, and no active exploitation or automation is evidenced. Priority should be driven by prevalence and impact, not by any confirmed in-the-wild signal, which is absent.

An attacker crafts a malicious font (or a document/web page embedding one) and delivers it via email attachment, a web page, or a shared file. When the victim opens the content, the Windows Graphics/Fonts component parses the malformed font and triggers a heap-based buffer overflow (CWE-122), allowing the attacker to execute arbitrary code in the victim's context. No public exploit was identified in the provided data, and user interaction is required for the attack to succeed.