Microsoft disclosed a double free vulnerability in the Windows Graphics Component that lets an unauthorized attacker execute code over a network, carrying a CVSS 3.1 score of 9.8 (Critical).
What Is It
CVE-2026-77493 is a double free condition in the Microsoft Graphics Component. According to Microsoft's advisory, the flaw "allows an unauthorized attacker to execute code over a network." The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes the worst-case profile for a memory corruption bug: network-reachable, low attack complexity, no privileges required, and no user interaction, with full impact to confidentiality, integrity, and availability.
The CVE was published on 2026-09-08 with a source identifier of [email protected]. NVD lists its status as "Undergoing Analysis," so enrichment such as CWE mapping and CPE data is not yet available.
Why It Matters
An unauthenticated, no-interaction remote code execution path in a component shared across the entire supported Windows line is about as broad as exposure gets. The Graphics Component is present on both client and server SKUs, including Server Core installations, which means the affected surface is not limited to desktop endpoints.
As of publication, CVE-2026-77493 does not appear in the CISA Known Exploited Vulnerabilities catalog. That means active exploitation is not confirmed by CISA, no ransomware campaign association is recorded, and no federal remediation due date applies. KEV status is a moving target; check the catalog directly before treating this as settled.
What's Vulnerable
Microsoft lists the following as affected, each below the indicated fixed build:
- Windows 10 1607 (< 10.0.14393.9512), 1809 (< 10.0.17763.9245), 21H2 and 22H2 (< 10.0.19044.7725 / 10.0.19045.7725)
- Windows 11 23H2 (< 10.0.22631.7582), 24H2 (< 10.0.26100.9445), 25H2 (< 10.0.26200.9445), 26H1 (< 10.0.28000.2954)
- Windows Server 2012 (< 6.2.9200.26349), 2012 R2 (< 6.3.9600.23397), 2016 (< 10.0.14393.9512), 2019 (< 10.0.17763.9245), 2022 (< 10.0.20348.5622), 2025 (< 10.0.26100.33438)
- Server Core installations of 2012, 2012 R2, 2016, 2019, and 2025 are affected on the same builds
One caveat on the build data: Windows Server 2025 and Windows 11 24H2 are built on the same 10.0.26100 base, yet the two entries above carry different fixed revisions (.33438 for Server 2025, .9445 for 24H2). Those cannot both describe the same servicing branch, so at least one revision is likely a transcription or feed artifact rather than a real threshold. Confirm the exact fixed build for 26100-based systems against the MSRC Security Update Guide entry before using it as a patch gate.
Platforms span 32-bit, x64-based, and ARM64-based systems depending on the release.
Patch Status
Fixed builds are published for every affected product listed above; the build numbers in the "less than" fields mark the patched threshold. No vendor-supplied workaround or mitigation is included in the source data. Apply the Microsoft update that brings each system to or above its listed fixed build, verifying the 26100-based thresholds against MSRC as noted.
Sources
- Microsoft Security Response Center; Security Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77493
- NVD, CVE-2026-77493: https://nvd.nist.gov/vuln/detail/CVE-2026-77493
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog