CVE-2025-59215
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A use-after-free vulnerability in the Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. Exploitation requires local access to the system.
Risk Assessment
An attacker with limited privileges may elevate them to a higher level, potentially leading to system compromise. This affects confidentiality, integrity, and availability.
Recommendation
Apply Microsoft security updates containing the fix for this component. Restrict local access to systems and enforce the principle of least privilege.
Other vulnerabilities in Microsoft Graphics Component
See all- CVE-2017-11824High
The Microsoft Graphics Component in Windows has a vulnerability that allows for elevation of privilege through improper handling of objects in memory. This affects multiple versions of Windows, including Windows Server 2008 and 2016, as well as Windows 7, 8.1, and 10.
- CVE-2017-11763High
The Microsoft Graphics Component in Windows allows remote code execution due to improper handling of specially crafted embedded fonts. This affects multiple versions of Windows, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016.
- CVE-2017-11762High
The Microsoft Graphics Component in Windows allows remote code execution due to improper handling of specially crafted embedded fonts. This affects multiple versions of Windows, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016.
- CVE-2017-8556High
In Microsoft Windows systems, including Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows Server 2012, Windows 10, and Windows Server 2016, there is a vulnerability that allows elevation of privilege due to improper handling of objects in memory by the graphics component.
- CVE-2017-0156High
An elevation of privilege vulnerability exists in Windows 7, 8.1, RT 8.1, 10, and Windows Server 2008 R2, 2012, 2012 R2, and 2016 due to improper handling of objects in memory by the Microsoft Graphics Component.
- CVE-2026-77493Critical
Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
- CVE-2025-60724Critical
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
- CVE-2026-85881High
Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
- CVE-2026-85338High
Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
- CVE-2026-70123High
Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS