CVE-2026-73018

CVE-2026-73018 is a heap-based buffer overflow (CWE-122) in Microsoft's Graphic Fonts component, disclosed and fixed through Microsoft's September 2026 security update cycle. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R), a remote, unauthenticated attacker can trigger the flaw with crafted font/graphics content that a user must render, for example by opening a malicious document or viewing untrusted content in an affected application. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability (base score 8.8). Any user of Microsoft products that include the Graphic Fonts component is potentially affected, though the source data does not enumerate the exact product names or version ranges. There is no known exploitation so far: the flaw is not in CISA KEV, no public proof-of-concept exists, and EPSS estimates only about a 0.8% chance of exploitation within 30 days (53rd percentile), but patching is still warranted given the RCE impact.

What to do: Apply Microsoft's September 2026 security updates as soon as practical, prioritizing user-facing systems (workstations, terminal/VDI hosts) where untrusted documents, email, or web content is rendered, and check Microsoft's advisory for the exact affected product/version list, which was not included in the source data. Because the attack requires user interaction (UI:R), mail/web content filtering and caution with untrusted font-bearing files reduce exposure while patching is underway. Monitor for updates to KEV and EPSS given the component's broad deployment.