CVE-2026-44812

Windows Graphics Component Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-09Updated 2026-07-23Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run any of these on your business devices: Windows 10/11 or Windows Server (2012/2012 R2/2016/2019/2022), and also Microsoft Word/Excel/PowerPoint for Android (where applicable).
On Windows devices, compare your Windows version/build to the fixed versions below and plan upgrades for any device that is not yet at (or above) the fixed level.
On Android devices, update Word/Excel/PowerPoint for Android to at least version 16.0.20131.20024.
Apply the available Microsoft update(s) for CVE-2026-44812 using the official Microsoft Update Guide, then reboot if your update process requires it.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Integer overflow or wraparound in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-44812 is a Windows/Office graphics bug that can let an attacker run code on the computer, and while it needs some user involvement, Windows users should patch now because the fix is available.

CVE-2026-44812 is a local remote-code-execution flaw caused by an integer overflow in the Windows Win32K graphics component (GRFX), allowing arbitrary code execution on affected systems without authentication but requiring user interaction.

If you're affected

Full device compromise
Malware installation
Data theft risk
Business disruption

What is it

This is a security weakness in a Windows graphics part that processes images and display features. If an attacker finds a way to trigger the bug, the attacker can run their own code on your device. Think of it like a mistake in how Windows “handles pictures”—if someone can feed it a specially crafted input, it can lead to takeover of the computer.

Who is affected

This matters if your business runs Microsoft Windows on endpoints or servers (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019/2022), or if you use Microsoft Word, Excel, or PowerPoint for Android. The flaw does not require the attacker to have an account, but it does require user interaction, so it typically involves a scenario where a victim is engaged with something (such as opening or using crafted content).

How urgent is it

This is a RED issue because it enables attackers to run arbitrary code on affected Windows systems when the flaw is triggered. Even though there is no confirmed public evidence in the provided sources of widespread exploitation, the impact is severe (code execution) and Microsoft has released fixed versions you can apply.

What to do — in detail

Confirm whether you’re affected

Windows endpoints/servers: For each device, note the OS version/build.
- Windows 10 fixed versions include:
  - 10.0.14393.9234
  - 10.0.17763.8880
  - 10.0.19044.7417
  - 10.0.19045.7417
- Windows 11 fixed versions include:
  - 10.0.22631.7219
  - 10.0.26100.8655
  - 10.0.26200.8655
  - 10.0.28000.2269
- Windows Server fixed versions include:
  - Windows Server 2012 → 6.2.9200.26132
Microsoft Office on Android (if your workforce uses these): check app versions for Word, Excel, and PowerPoint on Android.
- Fixed version for all three: 16.0.20131.20024

Upgrade to the fixed versions

Windows: Use the official Microsoft Update Guide for CVE-2026-44812 and install the relevant update for your OS branch/edition.
- Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44812
Android apps: Update Word/Excel/PowerPoint to at least 16.0.20131.20024.

If patching is delayed

Reduce exposure by tightening handling of untrusted content on affected devices (for example: limit opening unknown attachments/files and review whether users can download/open untrusted files from email, chat, or the web). The sources indicate user interaction is required, so controlling what users open is a practical interim control.

What to monitor after patching

Verify machines report the new update level and that the update applied successfully (per your normal patch compliance checks).
Continue to watch for standard signs of compromise (unexpected programs starting, unusual outbound connections, new persistence mechanisms), and ensure your antivirus/EDR is up to date—especially on systems where users handle files/media.

Exploitation status note (from provided sources)

The provided sources do not list CVE-2026-44812 in the CISA KEV database and do not provide clear dated reporting of exploitation in the wild or public exploit code on record.

Technical context

CVE-2026-44812 is a Windows local remote-code-execution issue stemming from an integer overflow (CWE-190) in the Windows Win32K graphics component (GRFX). The findings indicate no authentication required but user interaction is required, meaning an attacker still needs a scenario that gets a victim to trigger the vulnerable graphics path. The provided sources include Microsoft fixed versions for Windows 10, Windows 11, Windows Server 2012, and for Microsoft Word/Excel/PowerPoint for Android (16.0.20131.20024). No KEV listing was provided, and there is no public exploit code on record in the findings; press reporting cited is not an explicit claim of in-the-wild exploitation for this CVE. Given the RED verdict, treat it as a high-impact patching priority for affected systems even though broad exploitation confirmation is not included in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 44 days, from the signal feeds we watch.

2026-07-23Patch availablerecord updated
2026-06-25OpenVAS check added
2026-06-19Patch availablerecord updated
2026-06-09Publishedweakness classified, att&ck mapped

Affected products

Microsoft Corpcommercial · USaka Microsoft, microsoft corporation

And 54 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable