Windows Graphics Component CVE-2026-84000

Exploitation requires that the attacker hold a valid local user account on the target Windows system, corresponding to PR:L in the CVSS vector. No non-default configuration or specific feature enablement is described as a prerequisite - the vulnerable Graphics Component code path appears active in default Windows installations across all affected versions. The attack is confined to the local system (S:U, AV:L), meaning successful exploitation does not directly enable network-level lateral movement without additional steps. The primary limiting factor is the requirement for local authenticated access, making this most relevant to multi-user environments (RDS, terminal services, VDI), shared enterprise workstations, and any Windows host where standard user interactive logon is permitted. Remote unauthenticated exploitation is not possible under this attack vector.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the risk profile: local authenticated access is required (PR:L, AV:L), but once obtained, exploitation is low-complexity with no user interaction needed and full triad impact on the vulnerable system. No EPSS score was included in the provided data, no CISA KEV listing applies, and no public proof-of-concept has been identified - placing estimated real-world exploitation likelihood at moderate-low in the absence of these amplifying signals. The primary threat scenario is privilege escalation: a standard user elevating to SYSTEM-level code execution, making this most immediately dangerous in multi-user environments such as terminal servers, VDI farms, shared enterprise workstations, and kiosk deployments. The exceptionally broad version footprint - 19 affected build trains from Server 2012 to Windows 11 26H1 - means the patching surface is large, and heap-overflow primitives in the Windows graphics stack have historically been weaponized quickly once technical details circulate. The CVSS vector and description are internally consistent; no conflicting signals are detected.

A standard (non-admin) user on a shared Windows terminal server or enterprise workstation submits specially crafted graphics data - delivered via a malicious document, crafted image file, or direct API call to the Graphics Component - triggering the heap buffer overflow and corrupting adjacent memory structures. The attacker leverages the corrupted heap to redirect execution flow, gaining code execution at SYSTEM or elevated privilege. No public proof-of-concept has been identified, but the AC:L/UI:N CVSS metrics indicate exploitation requires no special timing or user action beyond submitting the crafted input.