CVE-2026-44803: Windows Graphics Component Remote Code Execution Vulnerability

Synopsis

An integer overflow in the Windows Graphics Component (Win32K - GRFX) allows a local attacker to execute arbitrary code on affected Windows systems. The vulnerability is reached locally and requires no authentication, but does require the victim to interact with a malicious file or content. Successful exploitation gives the attacker full code execution in the context of the affected process, with high impact to confidentiality, integrity, and availability. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows-based container images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationNot required

  No account or credentials are required to trigger the vulnerability; the attacker exploits it through user-mode access without prior authentication.

• Victim interactionRequired

  A user on the target machine must open or interact with attacker-controlled content, such as a malicious document or graphic file, for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors beyond obtaining victim interaction.

Blast Radius

• The attacker executes arbitrary code in the context of the process handling the malicious graphic content.
• All data accessible to that process is readable, including files, tokens, and in-memory secrets.
• The attacker can write or modify any data the process can access, including persisted files and registry entries.
• The affected process and any dependent services can be crashed or rendered unavailable.