Windows Win32K-GRFX Heap-Based Buffer Overflow RCE / VM Escape

CVE-2026-40403 is a Microsoft Windows Graphics Component vulnerability in Windows Win32K-GRFX caused by a heap-based buffer overflow. Microsoft classifies it as a Remote Code Execution vulnerability, although the attack vector is local rather than network-reachable. The flaw allows an authorized attacker to execute code locally with low privileges and no user interaction. Microsoft’s published context indicates the vulnerable endpoint is exposed only over the local VM interface, and exploitation may result in a scope change that can enable escape from a contained execution environment such as AppContainer or a guest virtual machine context to the host operating system.