Microsoft Graphics Component EUVD-2026-99169

Exploitation requires the attacker to already possess local, authenticated access to the target host (CVSS PR:L, AV:L) - this is a privilege-escalation primitive, not a remote entry point. The vulnerable code path is the Microsoft Graphics Component's handling of input affected by a numeric truncation error (CWE-122 heap overflow); no special non-default configuration is indicated by the description, and no user interaction is required (UI:N). The principal limiting factor is the need for prior local code execution or an interactive/standard-user session on an affected, unpatched Windows build (per EUVD version ranges); fully patched systems and hosts where the attacker has no local foothold are not exploitable.

This is a locally-exploitable elevation-of-privilege flaw with a CVSS 3.1 base score of 7.8 driven by the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - local attack vector, low complexity, low privileges required, no user interaction, and High confidentiality/integrity/availability impact. The signals are internally consistent: a numeric truncation error (CWE-122, heap-based buffer overflow) in the Microsoft Graphics Component that lets an already-authorized local user escalate to higher privileges. No EPSS score was provided, there is no CISA KEV listing in the input, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. Because this requires pre-existing local access (PR:L, AV:L), it is not a remote-wormable threat and ranks below network-facing unauthenticated flaws for initial access; however, it is a high-value post-compromise primitive and, given Microsoft's ubiquity and that it was self-reported by Microsoft (secure@microsoft.com) with a patch available, it should be prioritized in normal patch cycles. No conflicting signals were observed, though the absence of EPSS and KEV data means real-world exploitation likelihood cannot be quantified from the provided inputs.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) invokes the vulnerable Microsoft Graphics Component with crafted input that triggers the numeric truncation, corrupting the heap to run code at a higher privilege level such as SYSTEM. No user interaction is required, and low complexity (AC:L) means the technique is reliable once local access is obtained. No public exploit code is identified at time of analysis.