Microsoft Graphics Component EUVD-2026-35737

Attacker must already possess the ability to execute code locally on the target Windows host under any authenticated low-privileged user account (PR:L, AV:L); no user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no race window or unusual environmental tuning is needed. Limiting factors: remote network exploitation is not possible directly - the bug requires a local code-execution primitive first - and only Windows systems running the vulnerable Graphics Component build are affected; non-Windows hosts and fully patched systems are out of scope.

The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates local attack vector, low complexity, low-privileged authentication required, and no user interaction - a typical profile for a post-compromise privilege escalation. EPSS data was not provided, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation at this time. Microsoft Graphics Component UAFs have historically been attractive secondary-stage exploits paired with browser or document RCEs and have appeared in past KEV listings, so although there is no public PoC referenced here, defenders should treat this as a credible candidate for inclusion in exploit chains. Key data gap: no EPSS score, no confirmed KB number in the provided references, and tag-asserted 'Denial Of Service' impact appears inconsistent with the CIA:H privilege-escalation framing - verify the impact class with Microsoft's advisory before final triage.

An attacker who has already obtained a low-privileged foothold on a Windows host - for example via a phishing-delivered payload, a compromised user account, or a stolen RDP credential - executes a crafted local program that triggers the use-after-free in the Graphics Component, grooms the kernel/user heap to control the freed object, and pivots to SYSTEM-level code execution. From there the attacker disables EDR, harvests credentials from LSASS, and laterally moves. No public exploit identified at time of analysis, but historically similar Microsoft Graphics UAFs have been weaponized within months of disclosure.