CVE-2026-44812

What it actually does

This vulnerability is a local code execution flaw caused by an integer overflow or wraparound in the Windows Win32K graphics subsystem. An attacker who can cause a vulnerable system to process specially crafted graphics-related content or user-interface operations may be able to corrupt kernel-adjacent memory and execute code locally with the privileges available through the vulnerable component. Because Win32K is a core Windows graphics and window-management component, successful exploitation can lead to full compromise of confidentiality, integrity, and availability on the affected host. The CVSS vector indicates local attack, low attack complexity, no privileges required, and required user interaction, meaning exploitation typically depends on a user opening or interacting with malicious content rather than remote unauthenticated exploitation over the network.

Why it matters to the business

Successful exploitation could allow an attacker to take control of a Windows workstation or server after convincing a user to open malicious content, such as a crafted Office document or other graphics-rendered file. This can result in malware installation, credential theft, data access, lateral movement, business disruption, and potential endpoint or server outage. The affected product list spans widely deployed Windows client and server versions, as well as Office applications such as Excel, PowerPoint, and Word, so exposure may be broad in organizations that have not fully applied current Microsoft security updates. The vulnerability is not currently listed in CISA KEV, is not identified as ransomware-used, and has low EPSS at the time of assessment, but its high-impact local code execution characteristics make timely patching important, especially on user-facing endpoints.

How an attack unfolds

An attacker prepares content that triggers the integer overflow or wraparound condition in the Windows Win32K graphics path. The content is delivered through a user-driven vector such as a malicious document, presentation, spreadsheet, attachment, download, shared file, or web-delivered file that invokes vulnerable graphics rendering behavior. When the user opens or interacts with the content on an affected Windows system, the vulnerable component mishandles a size, length, coordinate, allocation, or arithmetic value, causing memory corruption. The attacker then attempts to shape memory so that the corruption results in controlled code execution. If successful, malicious code runs locally on the victim system, enabling actions such as payload staging, persistence, credential access, defense evasion, or movement to other systems. No public mature exploit or named threat actor activity is indicated in the supplied intelligence, so defenders should treat exploitation risk as plausible but not confirmed in the wild.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows and Office installations, including Microsoft Word, Excel, PowerPoint, Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 26H1, and Windows Server 2012, 2016, 2019, 2022, and 2025 where applicable. No exact fixed package versions were provided, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the vendor-released fix corresponding to this CVE. Prioritize user workstations, VDI images, terminal servers, Office-heavy systems, and internet-facing or file-processing servers. Where immediate patching is not possible, reduce exposure by limiting opening of untrusted documents, enforcing Protected View and Office macro/download protections, blocking files from untrusted sources, using application control, disabling unnecessary preview handlers, and ensuring endpoint detection and response tooling is active. Reboot systems after update installation where required to ensure kernel and graphics subsystem components are replaced.

How to confirm the fix worked

Confirm that affected Windows and Office systems report the applicable Microsoft security update as installed through Windows Update history, enterprise patch management inventory, or vulnerability scanning. Validate OS build numbers and cumulative update levels against Microsoft’s security update guidance for this CVE. For golden images and server templates, verify that the patched image has been rebuilt and redeployed rather than only patching running systems. Run authenticated vulnerability scans to confirm the CVE is no longer detected. On representative systems, verify that win32k-related system files have current patch timestamps and versions consistent with the Microsoft update. Confirm reboot completion after patching, because graphics/kernel components may remain in memory until restart. For compensating controls, test that Office Protected View, file blocking, attachment detonation, and endpoint protection policies are enabled and enforced.

Typical attack path

1. Identify organizations or users likely to open Office documents, graphics-heavy files, attachments, or downloaded content on affected Windows versions.
2. Create a malicious file or lure that exercises the vulnerable Win32K graphics code path and triggers the integer overflow or wraparound.
3. Deliver the file through phishing, collaboration platforms, file shares, removable media, or web downloads.
4. Convince the user to open or interact with the malicious content in Word, Excel, PowerPoint, or another application that causes Windows graphics rendering.
5. Trigger memory corruption in the Win32K graphics subsystem.
6. Execute attacker-controlled code locally on the affected system.
7. Deploy follow-on tooling such as loaders, credential theft utilities, persistence mechanisms, or remote access malware.
8. Use the compromised endpoint or server as a foothold for data theft, privilege escalation attempts, or lateral movement.

How to detect it

To determine whether exploitation may have already occurred, review endpoint and security telemetry around the time users opened suspicious Office documents, downloaded files, email attachments, or graphics-rich content. Focus on process lineage where Microsoft Office applications, email clients, browsers, archive utilities, or document viewers spawn unexpected command shells, scripting engines, LOLBins, installers, or remote access tools. Collect Windows Security logs, Sysmon logs, EDR process telemetry, Microsoft Defender alerts, Office application telemetry, email gateway logs, proxy/download logs, and crash reports from Windows Error Reporting. Look for application or system crashes involving Word, Excel, PowerPoint, document previewers, dwm.exe, explorer.exe, or win32k-related modules followed shortly by new executable creation, suspicious network connections, credential access behavior, persistence creation, or privilege escalation attempts. Since no public exploit maturity or named threat actors are provided, detection should rely on behavioral signs of malicious document execution and post-exploitation rather than a stable exploit-specific signature.

• WINWORD.EXE spawning cmd.exe
• WINWORD.EXE spawning powershell.exe
• WINWORD.EXE spawning wscript.exe
• WINWORD.EXE spawning cscript.exe
• WINWORD.EXE spawning mshta.exe
• WINWORD.EXE spawning rundll32.exe
• WINWORD.EXE spawning regsvr32.exe
• EXCEL.EXE spawning cmd.exe
• EXCEL.EXE spawning powershell.exe
• EXCEL.EXE spawning wscript.exe
• EXCEL.EXE spawning cscript.exe
• EXCEL.EXE spawning mshta.exe
• EXCEL.EXE spawning rundll32.exe
• EXCEL.EXE spawning regsvr32.exe
• POWERPNT.EXE spawning cmd.exe
• POWERPNT.EXE spawning powershell.exe
• POWERPNT.EXE spawning wscript.exe
• POWERPNT.EXE spawning cscript.exe
• POWERPNT.EXE spawning mshta.exe
• POWERPNT.EXE spawning rundll32.exe
• POWERPNT.EXE spawning regsvr32.exe
• Faulting module name: win32k
• Faulting module name: win32kfull.sys
• Faulting module name: win32kbase.sys
• Faulting application name: WINWORD.EXE
• Faulting application name: EXCEL.EXE
• Faulting application name: POWERPNT.EXE

What your security team should do

• Prioritize deployment of Microsoft security updates to Windows endpoints and servers that process user-supplied documents, email attachments, downloads, or shared files.
• Patch Office-heavy systems and user workstations first, especially those used by high-risk users such as executives, finance, HR, helpdesk, administrators, and developers.
• Use authenticated vulnerability scanning or endpoint management telemetry to identify unpatched Windows 10, Windows 11, Windows Server, Word, Excel, and PowerPoint installations.
• Enforce Office Protected View, block or sandbox files from the internet, and restrict previewing of untrusted attachments while patching is underway.
• Monitor for suspicious child processes spawned from Office applications, document viewers, browsers, archive tools, or email clients after users open files.
• Review endpoint telemetry for crashes in Office applications, graphics-related processes, or win32k-related faulting modules followed by new process creation or payload execution.
• Ensure EDR, attack surface reduction rules, and application control policies are active on endpoints where patching may lag.
• Because this vulnerability is not currently KEV-listed and has low EPSS, use risk-based prioritization, but do not defer beyond normal patch SLAs due to the high impact of successful code execution.