Microsoft Graphics Component CVE-2026-85338

Requires the attacker to already have local, authenticated low-privileged access to the target Windows system (PR:L, AV:L) - there is no remote or network-reachable path and no victim interaction is needed (UI:N). Exploitation is limited to the supported Windows builds below the patched revisions (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows 10 1809/Server 2019 before 10.0.17763.9376, Server 2022 before 10.0.20348.5761, Server 2025 before 10.0.26100.33650). No special non-default feature or configuration is called out in the description; the Graphics Component is a standard OS subsystem present on default installations, so the primary limiting factor is the prerequisite local foothold rather than any optional setting.

This is a locally-exploitable elevation-of-privilege flaw whose signals are internally consistent but point to moderate rather than top-tier urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) requires local access and existing low-level privileges, which bounds blast radius to attackers who already have a foothold (e.g., standard user or malware). The SSVC framework reinforces this as not-yet-urgent: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local vector that cannot be mass-sprayed remotely), but Technical Impact=total (consistent with C:H/I:H/A:H and a full privilege elevation once triggered). There is no CISA KEV listing and no POC reported in the input, so real-world exploitation pressure is currently low despite the high technical impact. One signal to verify: the root weakness is an out-of-bounds READ (CWE-125) tagged 'Information Disclosure', which typically yields C:H alone, yet the vector asserts I:H/A:H - plausible for an OOB read used as a privilege-escalation primitive (leaked kernel data defeats mitigations and enables memory corruption), but the full-impact claim rests on Microsoft's scoring and is not independently detailed in the description. Net: a real patch-this-cycle item as part of routine Patch Tuesday hygiene (especially on multi-user and server hosts), not an emergency drop-everything issue absent active exploitation.

An attacker who has already gained low-privileged code execution on a Windows host (via phishing payload, malicious installer, or a compromised service account) invokes the vulnerable Graphics Component code path to trigger an out-of-bounds read, leaking adjacent kernel/privileged memory. The leaked data is used to defeat ASLR/mitigations and chain into a full local privilege escalation to SYSTEM. No public exploit code is reported at time of analysis, and because the vector is local (AV:L) with no user interaction, exploitation is reliable but not remotely automatable.