CVE-2026-73006 – DirectWrite Remote Code Execution Vulnerability

CVE-2026-73006 is a critical remote code execution vulnerability caused by a stack-based buffer overflow in the Microsoft Graphics Component. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. Successful exploitation can execute code while creating high confidentiality, integrity, and availability impact.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-73006 is a stack-based buffer overflow, classified as CWE-121, affecting the Microsoft Graphics Component and identified as a DirectWrite remote code execution vulnerability. An attacker can deliver a specially crafted file over a network and persuade a user to open it. Processing that file can trigger the buffer overflow and enable unauthorized code execution. The attack has low complexity and requires no privileges, but successful exploitation depends on user interaction. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. Applicable 32-bit, x64, and ARM64 editions vary by Windows version. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute unauthorized code on an affected system, potentially compromising sensitive information, changing data, or disrupting system availability. Because no attacker privileges are required and attack complexity is low, malicious file delivery presents a significant organizational risk when vulnerable systems remain unpatched.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This patch should receive high deployment priority because the vulnerability is rated Critical, supports remote code execution, requires no attacker privileges, and has low attack complexity. Although exploitation is currently assessed as Less Likely and no active exploitation is reported, opening a specially crafted file can expose affected systems to high confidentiality, integrity, and availability impact.