CVE-2026-72986 – Graphic Fonts Remote Code Execution Vulnerability

CVE-2026-72986 is a critical remote code execution vulnerability in Microsoft Windows Graphic Fonts. A heap-based buffer overflow and integer overflow or wraparound can allow an unauthorized attacker to execute code when a user opens a specially crafted file. The attack requires no privileges, but user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can target affected Windows systems over a network using a specially crafted file. Attack complexity is low and no privileges are required, although the targeted user must open the malicious file. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: CVE-2026-72986 involves heap-based buffer overflow and integer overflow or wraparound weaknesses in Graphic Fonts. An unauthorized attacker can deliver a specially crafted file to a target over a network. When the user opens that file, the vulnerable font-processing behavior can trigger the memory corruption condition and allow remote code execution. The CVSS metrics identify network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected Windows systems, with high potential impact to data confidentiality, system integrity, and availability. In an organizational environment, a malicious file opened by a user could result in compromise of the affected system and disruption of business operations.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so organizations unable to patch immediately should recognize that no alternative mitigation is confirmed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution with no attacker privileges required. Although exploitation is assessed as Less Likely and no exploitation is reported, affected Windows systems should be prioritized for deployment of the official fix because successful exploitation can have high confidentiality, integrity, and availability impacts.