Critical Vulnerability CVE-2026-42833 Affects Multiple Microsoft Products

Microsoft has released security guidance for CVE-2026-42833, a critical vulnerability affecting multiple Microsoft products. The vulnerability could allow remote code execution if successfully exploited.

CVE-2026-42833 carries a CVSS score of 8.8, classified as High severity. The vulnerability exists in the way the Microsoft Windows Graphics Component handles objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.

Products affected include:

• Windows 10 Version 21H2 and later
• Windows 11 Version 22H2 and later
• Windows Server 2022
• Windows Server 2019
• Microsoft Office 2021
• Microsoft Office 2019

Microsoft has released security updates to address this vulnerability. Users should apply the latest security updates immediately. For Windows users, this can be done through Windows Update. For Microsoft Office users, updates should be applied through the Microsoft Update service or by downloading the updates directly from the Microsoft Security Response Center website.

Organizations using Windows Server should prioritize applying these updates during scheduled maintenance windows to minimize disruption.

Microsoft has not detected any known exploits targeting this vulnerability in the wild at the time of publication. However, given the severity and potential impact, organizations should treat this as a priority security issue.

For detailed information about the vulnerability and affected software, refer to the Microsoft Security Advisory MS23-1234.

Additional resources:

• Microsoft Security Response Center
• Windows Update Guide
• Microsoft Security Update Guide

The next security update release is scheduled for June 11, 2024, as part of Microsoft's regular Patch Tuesday cycle.