Windows Graphic Fonts CVE-2026-72986

Exploitation requires that a user on an unpatched Windows system open, preview, or render content containing a specially crafted font - delivered via a malicious Office document, PDF, email attachment, or web page. The CVSS PR:N metric confirms no authentication to the target system is required by the attacker; however, UI:R means the user must actively interact with attacker-controlled content. Font rendering is enabled by default across all affected Windows installations - no non-default configuration is required. Exploitation is bounded by the need for user interaction (UI:R) and by the requirement that the target system be running an unpatched build within the 19 confirmed affected product lines. Server Core installations are listed as affected, meaning headless server scenarios where a privileged user previews or processes attacker-supplied documents are also in scope.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a high-priority patch candidate: network-reachable, no privileges required, low complexity, and full triad impact. The sole friction for an attacker is convincing a user to interact with malicious content (UI:R), a barrier routinely defeated via phishing email, malicious Office documents, or drive-by web pages serving crafted fonts. No EPSS data was supplied, and the vulnerability is not currently in the CISA Known Exploited Vulnerabilities catalog, meaning active exploitation is not confirmed - but the 19 affected Windows product lines encompass an enormous real-world attack surface, and even a mid-sized municipal IT team in gliwice should treat this as urgent given that font rendering is active by default across every affected installation. The absence of a public proof-of-concept lowers immediate automated exploitation risk somewhat, though CWE-122 heap overflows in font parsers are a well-understood exploitation class with established techniques. Patch availability from Microsoft reduces risk for patched environments; unpatched endpoints remain fully exposed.

An attacker embeds a crafted font file inside a malicious Word document or serves a web page loading a specially constructed web font. When a targeted user on an unpatched Windows system opens the document or visits the page, the Windows Graphic Fonts parser processes the malformed font data, triggers a heap buffer overflow, and the attacker achieves arbitrary code execution in the context of the victim user. No public proof-of-concept has been identified, but the CWE-122 class and the breadth of the affected component's invocation surface (Explorer preview, Office, browsers) make social-engineering delivery straightforward.