CVE-2026-42986: Microsoft Graphics Component Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Microsoft Graphics Component allows a locally authenticated attacker to elevate privileges on affected Windows systems. The bug is reached locally and requires only a low-privilege account, with no network exposure and no victim interaction needed. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the host. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed to trigger the vulnerability.

• Victim interactionNot required

  The attacker can execute the exploit entirely on their own without requiring any action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other environmental factors.

Blast Radius

• Reads protected files, credentials, and secrets accessible to higher-privilege processes on the host.
• Modifies or overwrites system files, registry keys, and data owned by privileged accounts.
• Terminates or disrupts system services and processes running under elevated contexts.
• Achieves full local administrator or SYSTEM-level control over the compromised host.