Microsoft Graphics Component CVE-2026-77493

The vulnerable code path is the Windows Graphics Component's parsing of a crafted graphics/image object; exploitation requires that a Windows host receive and render such attacker-supplied content through a surface reachable per the network vector. Microsoft's vector claims no authentication and no user interaction (PR:N/UI:N), meaning the intended attack does not require valid credentials. Practical limiting factors: achieving reliable code execution from a double free generally requires heap grooming (raising real-world attack complexity), and many graphics-delivery paths depend on the victim opening or previewing the content unless a network-facing service auto-parses it; only supported Windows versions below the fixed build numbers are affected, and hosts already updated are not.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) presents this as trivially exploitable, unauthenticated, no-interaction network RCE - the highest-urgency profile. That should be treated with some skepticism for a graphics-parsing double free: reliable memory-corruption RCE typically requires heap grooming (arguing AC:H) and the victim usually must receive or view crafted graphic content, which for many delivery paths implies user interaction (UI:R) unless an auto-parsing/preview surface is reachable over the network. No EPSS score, CISA KEV entry, or POC was provided, so there is no evidence of active or automatable exploitation yet - the signal here is severity and blast radius, not confirmed in-the-wild activity. Net: prioritize patching because the component is on essentially every Windows host, but note the raw 9.8 likely overstates the practical ease of exploitation until a working technique surfaces.

An attacker delivers a specially crafted image or graphics object to a target - for example via a web page, document, or message that a Windows service or application renders - triggering the double free in the graphics component and grooming the heap to execute attacker-controlled code with the privileges of the rendering process. No public exploit code has been identified at time of analysis, so this reflects the CVSS network/no-auth profile rather than an observed campaign.