CVE-2026-73018 – Graphic Fonts Remote Code Execution Vulnerability

CVE-2026-73018 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in Graphic Fonts. An unauthorized remote attacker can target the vulnerability by getting a user to open a specially crafted file. Successful exploitation can allow code execution on the affected system. The vulnerability requires no attacker privileges, but user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. A successful attack requires a user to open a specially crafted file. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is rated Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: CVE-2026-73018 is a heap-based buffer overflow vulnerability in Graphic Fonts. An unauthorized attacker can remotely deliver a specially crafted file, but a targeted user must open that file to initiate remote code execution. The attack has low complexity and requires no privileges. Successful exploitation can execute code while causing high impact to confidentiality, integrity, and availability. The scope remains unchanged.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Supported architectures shown include 32-bit, x64, and ARM64 depending on the Windows version. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and cause high confidentiality, integrity, and availability impact. For organizations, a malicious file reaching an affected Windows endpoint or server could create a serious security event once opened by a user.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified as the remediation, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for remote code execution make timely deployment important, even though exploitation is currently assessed as Less Likely and is not reported as active.