High 7.8Published Apr 15, 2022

CVE-2022-26903Windows Graphics Component Remote Code Execution Vulnerability

Updated under an hour ago (Nov 2, 2026, 3:00 AM ET)

Does this affect you?

It affects microsoft excel and 15 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 2.66%, higher than 86% of scored CVEs.

Do this next

Start free and add your stackFree account, 3 products Every CVE for microsoft excel Exploited in the last 30 days

Windows Graphics Component Remote Code Execution Vulnerability

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 2.66% (percentile 86)
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 17, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

microsoft excel microsoft:excel	all versions	NVD
microsoft excel_mobile microsoft:excel_mobile	all versions	NVD
microsoft powerpoint microsoft:powerpoint	all versions	NVD
microsoft powerpoint_mobile microsoft:powerpoint_mobile	all versions	NVD
microsoft word microsoft:word	all versions	NVD
microsoft word_mobile microsoft:word_mobile	all versions	NVD
microsoft windows_10 microsoft:windows_10	all versions; 20h2; 21h1; 21h2; 1607; 1809; 1909	NVD
microsoft windows_11 microsoft:windows_11	all versions; all versions	NVD
microsoft windows_7 microsoft:windows_7	all versions	NVD
microsoft windows_8.1 microsoft:windows_8.1	all versions	NVD
1–10 of 16

References

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26903

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.