What is the CVSS score of CVE-2026-20846?

CVE-2026-20846 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows 10 1607 are affected by CVE-2026-20846?

A buffer over-read vulnerability in Windows GDI+ (CVE-2026-20846) enables remote attackers to cause denial of service attacks against affected systems.. A patch is available.

How to fix or mitigate CVE-2026-20846?

Within 24 hours: Identify and inventory all systems running affected Windows GDI+ versions; establish elevated monitoring for abnormal GDI+ process behavior and network-based DoS indicators. Within 7 days: Implement network segmentation to restrict GDI+ service exposure; disable GDI+ where operationally feasible; deploy WAF rules to block malicious GDI+ rendering requests. Within 30 days: Develop a patch management plan contingent on vendor release; conduct risk assessment for business-critical systems; evaluate workarounds and alternative rendering solutions.

Windows 10 1607 CVE-2026-20846

HIGH

Buffer Over-read (CWE-126)

2026-02-10 secure@microsoft.com

Buffer Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

AnalysisAI

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-126 (Buffer Over-read). Affects Windows 10 1607. Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.