CVE-2022-26927

Deeper analysis

CVE-2022-26927 is a remote code execution vulnerability affecting the Windows Graphics Component. It carries a CVSS 3.1 base score of 8.8 with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network-accessible attack potential that can result in complete loss of confidentiality, integrity, and availability when successfully triggered.

An unauthenticated attacker can exploit the flaw over a network by convincing a user to interact with specially crafted content, after which arbitrary code executes in the context of the current user. The absence of required privileges and the low attack complexity lower the bar for successful exploitation once user interaction occurs.

Microsoft has published official security guidance and patch information for CVE-2022-26927 through its update channels at the referenced MSRC URLs. The current EPSS score of 0.2812 matches its recorded peak, showing no material post-disclosure rise that would indicate emerging exploitation interest.