CVE-2021-24093: Windows Graphics Component buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (98.75th percentile) make this a serious remote code execution risk despite the absence of KEV listing.

What it is

CVE-2021-24093 is a remote code execution flaw in the Windows Graphics Component, specifically a buffer overflow in Microsoft DirectWrite's fsg_ExecuteGlyph handling per the third-party advisory. It matters because successful exploitation gives an attacker full control of the affected system, and the CVSS 3.1 base score is 8.8 (HIGH).

Impact

An attacker who exploits the flaw can execute arbitrary code in the context of the current user, with high impact to confidentiality, integrity and availability. If the victim has administrative rights, the attacker could take over the host.

Attack surface

The vector is network-reachable (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R), meaning the victim must open or render crafted content. The record does not specify the exact delivery mechanism beyond the graphics component.

Exploitation

CISA KEV does not list this CVE and no ransomware use is documented, but EPSS is high at 0.46053 (98.75th percentile), indicating elevated likelihood of attempted exploitation. The Packet Storm reference describes a DirectWrite buffer overflow, suggesting public technical detail exists.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-24093 as the first action.
• Restrict or block untrusted document and font content from reaching the Windows Graphics Component where business processes allow.
• Keep Windows 10, Windows Server 2016 and Windows Server 2019 systems current with Microsoft security updates.
• Run users with least privilege so code execution does not inherit administrative rights.

Detection

• Monitor for crashes or abnormal process terminations in graphics or font rendering components such as DirectWrite.
• Hunt for suspicious child processes spawned by document viewers, browsers or font rendering services.
• Review endpoint telemetry for exploitation attempts against graphics-related DLLs on unpatched Windows 10 and Server 2016/2019 hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.