CVE-2026-73017 – Graphics Kernel Remote Code Execution Vulnerability

CVE-2026-73017 is a Critical heap-based buffer overflow vulnerability in the Windows Graphics Kernel. An authorized local attacker with high privileges could manipulate system components to trigger the flaw and execute code. Exploitation requires high attack complexity but no user interaction.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: The vulnerability can result in remote code execution impact after successful local exploitation. The CVSS assessment rates potential confidentiality, integrity, and availability impact as High, with scope changed. An attacker requires high privileges and must overcome high attack complexity.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-73017 is caused by a heap-based buffer overflow (CWE-122) in the Windows Graphics Kernel. Successful exploitation requires an authorized attacker with high privileges to operate locally and manipulate system components to trigger a specific condition. Attack complexity is High, meaning exploitation depends on factors such as the environment and system configuration and is not guaranteed. If successful, the vulnerability allows code execution and can have High impact on confidentiality, integrity, and availability. No user interaction is required.

EXPLOITABILITY: Affected products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. A local attacker needs high privileges and high attack complexity to exploit the vulnerability.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code execution and compromise sensitive information, system integrity, and service availability. On affected business systems and servers, this could increase the impact of an attacker who has already obtained significant local privileges.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical and has High potential impact across confidentiality, integrity, and availability. Although exploitation is assessed as Less Likely, is not publicly disclosed, and is not known to be exploited, affected Windows systems should receive the official security update according to the organization’s priority deployment process.