CVE-2026-84000

CVE-2026-84000 is a heap-based buffer overflow (CWE-122) involving an integer-overflow condition (CWE-190) in the Microsoft Graphics Component. An attacker who is already authorized on the machine with low privileges can trigger the overflow locally, with no user interaction required per the CVSS vector (AV:L/AC:L/PR:L/UI:N). Successful exploitation yields local code execution with high impact on confidentiality, integrity and availability (C:H/I:H/A:H), consistent with an elevation-of-privilege outcome on the affected system. Any supported Windows system containing the Graphics Component is affected, and Microsoft addressed the flaw among the 973 vulnerabilities fixed in the September 2026 Patch Tuesday release. Exploitation has not been observed: the bug is not on CISA's KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Apply Microsoft's September 2026 security updates (Windows cumulative updates) to all supported Windows clients and servers, checking Microsoft's advisory for the exact KB/article numbers for each OS version. Prioritize endpoints where untrusted users can execute local code, such as shared workstations, VDI hosts and kiosks. With no public PoC or in-the-wild exploitation reported, standard patch-cycle urgency is adequate, but verify deployment rather than deferring past the next monthly cycle given the high local-impact rating.