CVE-2026-40403 HIGH

CVE-2026-40403: Windows Graphics Component Remote Code Execution Vulnerability

Vendor Microsoft
Product Windows 10 Version 1607
Weakness CWE-122
Published May 12, 2026
Last update June 9, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
June 9, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-35630 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability CVE-2023-42039 Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVE-2022-38701 IPC in communication subsystem has a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information. CVE-2026-25794 ImageMagick has heap-buffer-overflow via signed integer overflow in `WriteUHDRImage` when writing UHDR images with large dimensions CVE-2020-27250