Microsoft Graphics Component CVE-2026-69467

The attacker must have local access to the target Windows system with at least a standard (low-privileged) user account - this is reflected in the CVSS PR:L rating. No user interaction beyond the attacker's own actions is required (UI:N), and no special non-default configuration is needed; the Microsoft Graphics Component is present and active by default across all affected Windows 10 and 11 versions. Exploitation is limited by the requirement for prior local code execution: the attacker cannot trigger this remotely without first compromising an account or service on the machine. Remote Desktop, VDI, shared terminal server sessions, and browser sandbox escapes are realistic delivery paths that provide the local foothold needed to leverage this escalation.

The CVSS 7.8 score accurately reflects a high-severity local privilege escalation with low attack complexity and no user interaction required - an attacker already on the box with a standard account can reliably escalate. The AV:L vector limits exposure compared to network-reachable vulnerabilities: the attacker must first obtain local code execution, making this most valuable as a second-stage post-compromise primitive. EPSS data is not provided in the input; however, the low complexity and broad Windows footprint (ubiquitous deployment) suggest non-trivial exploitation probability once an attacker is local. No KEV listing and no public POC are identified, so mass exploitation is not currently confirmed. Real-world priority is elevated for environments with shared workstations, RDS/VDI deployments, or where lateral movement via standard user accounts is a realistic threat path. Organizations with strong EDR and least-privilege enforcement have meaningful compensating controls, but patch application remains the definitive mitigation.

An attacker who has gained a foothold on a Windows system - through phishing, credential theft, or exploitation of a remote service - running under a standard low-privileged user account crafts input that triggers the stack-based buffer overflow in the Graphics Component. With no user interaction or additional authentication required, the attacker overwrites the return address on the stack and redirects execution to shellcode or a ROP chain, elevating the process to SYSTEM-level privileges. No public POC exists at time of analysis, but the low-complexity rating indicates exploitation is straightforward once the overflow offset is determined.