Windows Graphics Component CVE-2026-83990

Exploitation requires local authenticated access with at minimum a standard (low-privileged) user account on the target Windows system, as reflected in the CVSS PR:L metric. The attack vector is local (AV:L), meaning the attacker must already have an interactive session, remote desktop session, or equivalent presence on the machine - remote unauthenticated exploitation over the network is not applicable. No user interaction beyond the attacker's own actions is required (UI:N). No specific non-default configuration is described as necessary; the vulnerability appears to reside in a component present in default Windows installations across all listed versions. The primary limiting factor is the prerequisite of local authenticated access, which restricts exploitation to scenarios where an attacker has already achieved initial compromise.

The CVSS base score of 7.8 with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately captures the risk profile: high-impact local privilege escalation with low attack complexity, requiring only a foothold as a standard user. No EPSS score was provided in the input data. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Despite the absence of public exploitation, the low attack complexity (AC:L) means that once a working exploit is developed, it would be reliable and broadly applicable across the wide range of affected Windows builds - even a mid-sized IT operation managing a significant Windows Server 2022 or 2025 estate should treat this as an urgent patching priority within normal patch cycle timelines. The primary risk scenario is post-compromise escalation: an attacker who gains initial access through phishing, credential theft, or another vector would leverage this flaw to achieve SYSTEM-level persistence.

An attacker who has already established a foothold as a low-privileged local user - via phishing, credential reuse, or another initial access technique - invokes a crafted graphics operation that triggers the stack buffer overflow in the Graphics Component. The overflow overwrites the saved return address on the stack, redirecting execution to attacker-controlled shellcode or a ROP chain, ultimately achieving code execution in a SYSTEM-level context. No public proof-of-concept has been identified, but the AC:L rating suggests limited defensive complexity once a working exploit is constructed.