CVE-2026-100215

CVE-2026-100215 is a heap-based buffer overflow (CWE-122) in the Microsoft Graphics Component. An unauthorized attacker can trigger it locally when a user interacts with malicious content, and no privileges are required beforehand. Successful exploitation can execute arbitrary code with high impact to confidentiality, integrity, and availability on the affected system (CVSS 3.1 base score 7.8). It affects Windows systems that include the Microsoft Graphics Component and were covered by Microsoft's October 2026 security updates; exact version ranges are not stated in the supplied data. It is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.

What to do: Install Microsoft's October 2026 security updates that patch the Graphics Component on all supported Windows systems, and prioritize endpoints that open untrusted images, documents, or other content that uses that component. Until patches are deployed, reduce exposure by limiting local users' ability to open untrusted graphics content and by applying standard least-privilege controls. There is no public proof-of-concept and the issue is not listed in CISA KEV, but the local code-execution impact still warrants prompt patching.