Heap-based buffer overflow in Microsoft Windows - CVE-2026-102209
Published: October 13, 2026
Vulnerability identifier: #VU154266
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102209
CWE-ID: CWE-122
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain SYSTEM privileges.
The vulnerability exists due to a heap-based buffer overflow in Microsoft Graphics Component when exploited locally. A local user can exploit the overflow to gain SYSTEM privileges.
Successful exploitation requires a deep understanding of the system and is not guaranteed. Success may depend on the environment, system configuration, and the presence of additional security measures.
Affected software
Microsoft Windows
How to mitigate CVE-2026-102209
Install security update from vendor's website.
Microsoft Windows - update to 11 26H1 10.0.28000.3231