CVE-2026-20822CWE-416

CVE-2026-20822

High · published January 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
31.8
In the wild
Unconfirmed
What it is

⚡ A sneaky use after free in Microsoft Graphics Component could let a local attacker elevate their privileges without breaking a sweat! 😱 Think of it like a magic trick where an illusionist gets access to a locked vault because they know the secret exit — an authorized user can exploit this vulnerability to gain unwarranted access. This means an attacker could potentially do anything, from accessing sensitive data to executing malicious files, putting your entire system at serious risk. Imagine the chaos if someone could suddenly act as an admin without permission!

Put simply

Think of it like a magic trick where an illusionist gets access to a locked vault because they know the secret exit — an authorized user can exploit this vulnerability to gain unwarranted access. The use after free vulnerability in Microsoft Graphics Component occurs when the program continues to use memory that has already been freed, leading to unpredictable behavior and potential privilege escalation for authorized users.

What to do

This means an attacker could potentially do anything, from accessing sensitive data to executing malicious files, putting your entire system at serious risk. Imagine the chaos if someone could suddenly act as an admin without permission! To shield your system, update your Microsoft Graphics Component to the latest version available immediately. Regularly audit user permissions to ensure that only authorized individuals have administrative access. You've got this! Follow these steps to secure your system and keep your data safe! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00389 · 31.8th percentile
Weakness
CWE-416 · Use After Free
Published
2026-01-13T23:16Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Graphics Component Elevation of Privilege Vulnerability
    cvelistv5