Loading vulnerability…
Microsoft Graphics Component Heap-Based Buffer Overflow Code Execution
CVE-2026-100215 is a heap-based buffer overflow in Microsoft Graphics Component that allows attacker-controlled code execution when a user opens a specially crafted document or visits a webpage containing specially crafted embedded OpenType fonts. Successful exploitation executes code with the authenticated user's permissions. Although classified as remote code execution, its CVSS v3.1 metrics specify a local attack vector, low attack complexity, no required attacker privileges, and required user interaction. The vulnerability is rated Critical with a CVSS base score of 7.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of resources accessible to the affected user. An attacker could access sensitive information, modify or destroy data, execute malicious programs, and disrupt applications or business operations. Access to additional organizational resources depends on the compromised user's permissions; elevated privileges are not an inherent outcome.
If you can’t patch tonight, do this now.
No official workaround or mitigation has been identified by Microsoft. Temporary exposure-reduction measures include restricting untrusted documents and suspicious websites, applying email and web security controls, enforcing least privilege, and monitoring endpoints for suspicious activity. These measures do not remove the vulnerability and are not substitutes for security updates.
Patch, then assume compromise.
Apply the applicable Microsoft security updates for CVE-2026-100215 to affected Windows, Windows Server, and Visual Studio installations. Prioritize systems handling sensitive information, restart systems after installation, and verify that updates were successfully deployed. Exact fixed build versions are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.