Loading story…
Microsoft disclosed two critical Windows Graphics Component remote code execution vulnerabilities, CVE-2026-44812 and CVE-2026-44803, both tied to integer overflow or wraparound issues in Windows Win32K-GRFX. The flaws can let an unauthorized attacker execute code locally if a user views a specially crafted file in the Windows File Explorer Preview Pane or opens the file directly. Microsoft rated both issues CVSS 7.8, said exploitation is more likely, and reported that neither vulnerability had been publicly disclosed or exploited at the time of publication.
Microsoft said official fixes are available for the Windows issues, while updates for Microsoft Word for Android, Microsoft PowerPoint for Android, and Microsoft Excel for Android were not yet available and will be released later through revised advisories. The company credited Kyeongmin Kim (@hareh4ru) of KAIST Hacking Lab, Seung Chan Kim, and SnowRockLab for reporting CVE-2026-44812; the related advisory for CVE-2026-44803 similarly noted pending Android app updates and high impact to confidentiality, integrity, and availability.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft disclosed CVE-2026-44812, a critical Windows Graphics Component remote code execution vulnerability in Windows Win32K-GRFX, and stated that an official fix is available. Microsoft also noted the issue had not been publicly disclosed or exploited at publication and credited KAIST Hacking Lab, Seung Chan Kim, and SnowRockLab for reporting it.
Microsoft disclosed CVE-2026-44803, a critical Windows Graphics Component remote code execution vulnerability in Windows Win32K-GRFX, and indicated that an official fix is available. The company said exploitation was considered more likely, but the flaw was not publicly disclosed or observed exploited at publication.
Microsoft published its Security Update Guide entry for CVE-2021-28349, a Windows GDI+ remote code execution vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched several remote code execution vulnerabilities affecting **Microsoft Office**, **Excel**, and Windows graphics components, including `CVE-2026-42831`, `CVE-2026-26108`, `CVE-2025-49742`, `CVE-2024-49031`, `CVE-2024-49065`, and `CVE-2026-35421`. The issues span Office document handling, Excel, the **Office Graphics** stack, the **Windows Graphics Component**, and **Windows GDI**, indicating broad exposure across common user-facing software used to process files and render content. Microsoft said `CVE-2026-42831` is a **heap-based buffer overflow** in Microsoft Office that can allow code execution when a user opens a malicious Office file. The flaw carries a **CVSS 7.8** score, requires user interaction, and is **not exploitable through the Preview Pane**; Microsoft also said it was **not publicly disclosed**, **not observed in the wild**, and assessed as **less likely to be exploited**, with a security fix available. The related advisories point to a recurring risk pattern in which crafted documents or graphics content can trigger code execution on victim systems, reinforcing the need to prioritize patching for Office and Windows rendering components.
Jun 29, 2026
Microsoft disclosed and fixed two critical use-after-free vulnerabilities affecting **Microsoft Office** and **Microsoft Word**: `CVE-2026-40358` and `CVE-2026-40366`. Both bugs are classified as **CWE-416** and carry a **CVSS 8.4** rating, with Microsoft assessing impacts to confidentiality, integrity, and availability as high. The company said neither flaw had been publicly disclosed or exploited in the wild at the time of publication, and it rated exploitation as less likely. Microsoft said the vulnerabilities can lead to remote code execution, although the attack vector is described as **local**, with the **Preview Pane** able to serve as an attack path when malicious content is handled. The disclosures continue a broader pattern of Microsoft patching multiple remote code execution issues across its product line, including earlier Office flaws such as `CVE-2024-30101`, `CVE-2025-24080`, and `CVE-2025-59234`, as well as RCE bugs in Windows Connected Devices Platform Service, Remote Desktop Protocol, and Inbox COM Objects.
Jun 29, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026