AI analysis
CVE-2026-102225 is an out-of-bounds read, also associated with a numeric truncation error, in Windows Text Shaping. An unauthorized attacker on the network can trigger it by getting a user to open or render malicious content that exercises the text-shaping component; no privileges are required, but user interaction is. Successful exploitation can lead to remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). It affects Microsoft Windows systems that include Windows Text Shaping and that are covered by the October 2026 security updates. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Install Microsoft's October 2026 Patch Tuesday security updates for every supported Windows client and server as soon as they are available for your builds. Until systems are patched, treat untrusted documents, messages, and web content that force complex text rendering as risky, because exploitation requires a user to open or render attacker-controlled content. Confirm the update is installed and prioritize internet-facing and high-value hosts.
Affected
| Microsoft Windows Text Shaping (Windows) | — |
Estimated exposure
massOn the order of hundreds of millions to over 1 billion Windows installations — Windows Text Shaping ships with mainstream Windows client and server releases, which together account for well over a billion installed systems worldwide; exact vulnerable build counts are not published.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.