CVE-2026-23668

—

CVSS 3.1

7.0 high

EPSS

4%p89

Published

Mar 10, 2026 (Mar 10, 2026)

Modified

Jun 17, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Vendors: microsoft
Products: windows 10 1607, windows 10 1809, windows 10 21h2, windows 10 22h2, windows 11 23h2, windows server 2012, windows server 2016, windows server 2019, windows server 2022, windows server 2022 23h2
Weakness: CWE-362
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.6%)

In the news4 stories

Microsoft patches 80+ vulnerabilities, six flagged as "more likely" to be exploited

Help Net SecurityMar 19, 10:31 UTC · Mar 19, 2026Vulnerability in the wildCVE-2026-21262 CVE-2026-26127 CVE-2026-24289+10 CVEs

Microsoft Fixes Two Publicly Disclosed Zero

Infosecurity MagazineMar 11, 09:20 UTC · Mar 11, 2026Exploit / PoC CVE-2026-21262 CVE-2026-26127 CVE-2026-23668+2 CVEs

Microsoft Patch Tuesday for March 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMar 10, 22:23 UTC · Mar 10, 2026Vulnerability CVE-2026-26110 CVE-2026-26113 CVE-2026-26144+14 CVEs

Microsoft’s monthly Patch Tuesday is first in 6 months with no actively exploited zero

CyberScoopMar 10, 19:37 UTC · Mar 10, 2026Vulnerability in the wildCVE-2026-21262 CVE-2026-26127 CVE-2026-23668+8 CVEs