Windows GDI CVE-2026-35421

Exploitation requires local delivery of attacker-controlled content that Windows GDI will parse (e.g., a crafted image, font, or metafile) and requires user interaction (CVSS UI:R) - the victim must open or view the malicious file. No authentication or prior privileges are needed (PR:N), and the attack does not cross a privilege boundary (S:U), so the attacker gains code execution only in the context of the user who opens the content. The attack vector is local (AV:L), meaning it cannot be triggered remotely over the network without first getting the file onto and opened on the target. Limiting factors: the required user interaction, the need to socially engineer file opening, and per-SKU patch levels all constrain realistic exploitation; the affected code is present across default Windows installations, so no non-default configuration is required.

The signals are internally consistent and point to moderate, non-urgent risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, base 7.8) shows local attack vector with required user interaction but no privileges - meaning an attacker cannot reach GDI remotely and must get a victim to open crafted content. EPSS is 0.06% (18th percentile), and CISA SSVC records Exploitation: none and Automatable: no, which agree with the low-probability, interaction-gated profile; however, SSVC Technical Impact is 'total', matching the C:H/I:H/A:H code-execution outcome. There is no KEV listing and no POC identified, so despite the 'total' technical impact this is not an active-exploitation priority. No major conflicts exist in the data: the local vector, required user interaction, and low EPSS all corroborate a real-but-not-widespread threat suitable for standard monthly patching.

An attacker crafts a malicious image, font, or document that triggers the GDI heap overflow when rendered, then delivers it via email, a web download, or a shared file. When the targeted user opens the file, GDI processes the malformed data, overflows the heap, and executes attacker code in the user's security context. No public exploit code has been identified, so this would currently require an attacker to develop a working exploit.