CVE-2026-44812: Windows Graphics Component Remote Code Execution Vulnerability

Synopsis

An integer overflow in the Windows Graphics Component (Win32K - GRFX) allows a local attacker to execute arbitrary code on affected systems. The vulnerability is reached locally, requires no authentication, but does require a user to open a malicious file or interact with crafted content. Successful exploitation gives the attacker full control over the affected process, with high impact to confidentiality, integrity, and availability. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credentials are needed to exploit this vulnerability; the attack vector does not require authentication (PR:N).

• Victim interactionRequired

  A user must take an action such as opening a malicious document or viewing crafted graphical content for the exploit to trigger.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions or race conditions are required; the attack succeeds consistently when the victim interacts with the malicious content.

Blast Radius

• Executes arbitrary code in the context of the affected user or process, giving the attacker control over that execution environment.
• Reads protected files, credentials, or session data accessible to the compromised process.
• Modifies or deletes files and data within the scope of the compromised process.
• Crashes or destabilizes the affected Windows graphics subsystem, causing service disruption for the user session.