EUVD-2026-100416
GHSA-w932-fcmg-fmm6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted font/shaping data over network
-
DeliveryVictim component parses malformed data
-
ExploitTrigger heap buffer overflow in Text Shaping
-
ExecutionCorrupt heap and hijack control flow
-
ImpactExecute arbitrary code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable code path requires the Windows Text Shaping component to process attacker-supplied font or text-shaping data - triggered whenever an application renders untrusted content containing crafted/embedded fonts or shaping instructions (documents, web pages, messages, or network-delivered files). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and, as scored, no user interaction, implying an attacker-controlled data stream can reach the parser automatically in affected configurations. Limiting factors: exploitation depends on a Windows application actually invoking Text Shaping on the malicious data, and reliability may require heap-grooming to achieve code execution rather than a crash; exact affected Windows versions were not confirmed from the available data, so unaffected/patched builds limit the real-world exposure. |
| Impact | All provided signals point to a high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction, with full H/H/H impact yielding the 9.8 base score - the classic profile of a wormable remote code execution flaw. Windows Text Shaping (DWrite/font-shaping) is a widely reachable component often exercised when rendering untrusted content (documents, web pages, embedded fonts), which raises exposure. However, several real-risk signals are MISSING from the input and must not be assumed: no EPSS score was provided, KEV status is not listed (treat as not confirmed), and no POC/exploit code is referenced. Therefore this is 'no public exploit identified at time of analysis' despite the critical CVSS. Net: a genuine high priority to patch given the pre-authentication RCE profile, but there is currently no evidence of active exploitation or public exploit availability - patch urgency rests on severity and the component's broad reachability, not on observed in-the-wild activity. |
| Exploit ScenarioDerived | An attacker delivers content containing a maliciously crafted font or shaping data (e.g., via a web page, document, or network-delivered file) that is processed by the Windows Text Shaping component. When the victim's system parses the malformed data, a heap-based buffer overflow (CWE-122) is triggered, allowing the attacker to execute arbitrary code in the context of the rendering process. No public proof-of-concept is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Heap-based buffer overflow in the Windows Text Shaping component can let an unauthenticated remote attacker execute arbitrary code by delivering crafted font or text-shaping data to an application that renders untrusted content. It is scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122), i.e. no authentication and, as scored, no user interaction, though real-world exploitation depends on an affected Windows application actually invoking Text Shaping on the malicious data and reliable code execution may require heap grooming rather than a simple crash. No public exploit code and no CISA KEV entry were identified at time of analysis, and the specific affected Windows versions were not confirmed from the available data.
RemediationAI
No exact fix version was provided in the available data, so the primary action is to apply the Windows security update published through the Microsoft Security Response Center guide for CVE-2026-97814 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-97814), using the affected-build and KB information there to determine which builds are patched; patch status is best described as available per the vendor advisory, with the specific release not independently confirmed here. Until that update is deployed on every affected build, treat the component as remotely reachable through untrusted content and reduce exposure with concrete compensating controls: restrict or block processing of untrusted and embedded fonts in high-risk channels (disable embedded/web font rendering in browsers and document viewers, and block font files from untrusted network locations and email attachments), and, on Windows builds that support the font-blocking policy, enable untrusted font blocking (EnableUntrustedFontBlocking / the untrusted-font group policy) so system processes do not parse non-system fonts, accepting the trade-off that legitimate third-party or custom fonts will fail to render and some line-of-business and document workflows may break. Enterprise-side mitigations include network segmentation and filtering to prevent attacker-supplied documents from reaching interactive workstations, tightening attachment and download controls, and prioritizing rapid patching of internet- and content-facing hosts; note that exploit reliability may require heap grooming, so a crash-free exploitation attempt is not a reliable indicator that a given build is immune.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a heap-based buffer overflow (CWE-122) in Windows Text Shaping, the font and glyph-layout processing path used when the operating system parses font tables and computes glyph positioning for text rendering (the same broad class of parsers associated with DirectWrite/Uniscribe-style shaping engines and OpenType font handling). The root cause class is a memory-safety defect in which a length, offset, or glyph-count value derived from attacker-influenced font or shaping input is not validated against the destination heap buffer, so an over-long copy or under-sized allocation corrupts adjacent heap structures; subsequent control of that corrupted memory can be converted into code execution, typically requiring heap grooming to make the overwrite deterministic. Because the vulnerable parser is reached through data rather than a listening service, the attack surface is any code path that shapes untrusted text, including network-delivered documents, web content with embedded or downloaded fonts, messages, and file shares, which matches the AV:N/AC:L/PR:N/UI:N vector supplied in the vendor data and our independent assessment. No CPE strings were included in the input, so the exact set of affected Windows builds (and whether this affects Win32 rendering, kernel-side font parsing, or both) could not be enumerated from the available evidence; the only authoritative product-mapping source provided is Microsoft's MSRC update guide entry for CVE-2026-97814.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-delivered malformed font/shaping data reaches the parser with no auth or interaction (AV:N/AC:L/PR:N/UI:N), and heap-overflow RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft Windows systems that process untrusted fonts or text-shaping data are exposed to a critical remote code execution vulnerability (CVE-2026-97814). Successful exploitation could allow an unauthenticated attacker to take control of affected endpoints, leading to data theft, ransomware deployment, or lateral movement across the organization. No public exploit identified at time of analysis, but leadership should prioritize patching because the vulnerability is remotely exploitable without authentication.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB