Microsoft Graphics Component CVE-2026-73006

User interaction is required: a victim must open, preview, or render attacker-controlled graphical content - for example, opening an email attachment, previewing a file in Windows Explorer, or visiting a web page that causes the browser to render a crafted image. No authentication or elevated privileges are required on the attacker's side (PR:N per CVSS vector). The attack is reachable over the network (AV:N), so malicious content can be delivered remotely without any prior foothold on the target network. The sole limiting factor is the UI:R requirement: automated exploitation without user interaction is not possible. All supported Windows 10, Windows 11, and Windows Server 2016 through 2025 SKUs running unpatched builds are within scope regardless of deployment configuration.

The CVSS 8.8 High rating with AV:N/AC:L/PR:N/UI:R reflects a realistic, low-friction attack: no authentication is required, complexity is low, and the only barrier is convincing a user to open or preview malicious content - a routine phishing vector. Full C:H/I:H/A:H impact reflects arbitrary code execution in the victim's session context. The fifteen distinct affected Windows SKUs mean virtually every Windows-based organization is exposed. No EPSS data was included in the supplied intelligence, limiting probabilistic exploitation assessment. No CISA KEV listing was found at time of analysis, suggesting exploitation has not yet been confirmed in the wild; however, graphics-parsing vulnerabilities in Windows have historically attracted rapid weaponization after Patch Tuesday disclosure. The UI:R requirement prevents fully automated propagation - no worm-style spreading is possible without user interaction - but does not meaningfully reduce risk in phishing-heavy threat environments where opening attachments or previewing files is routine user behavior.

An attacker crafts a malicious graphics file - such as a specially constructed EMF, WMF, or other Windows-native image format - and delivers it via a phishing email attachment or as an embedded image on an attacker-controlled web page. When the victim opens the attachment, previews it in Windows Explorer, or navigates to the web page, the Windows Graphics Component parses the file and triggers the stack buffer overflow, redirecting execution to attacker-supplied shellcode and granting arbitrary code execution in the victim's user context. No public proof-of-concept exploit was identified at time of analysis.