Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable image parsing with no auth (AV:N/PR:N) but mandatory user open (UI:R); shared GDI+ component yields scope change (S:C) and memory-corruption RCE gives full C/I/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Windows GDI+ (gdiplus) lets an unauthenticated network attacker run arbitrary code when a victim opens or renders a specially crafted image, via a heap-based buffer overflow (CWE-122). The flaw affects a broad range of supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). It carries a critical CVSS 9.6 with a scope-changed impact, but requires user interaction and currently has no public exploit identified at time of analysis.
Technical ContextAI
GDI+ (gdiplus.dll) is the Windows graphics subsystem library responsible for parsing and rendering image formats (JPEG, PNG, TIFF, EMF/WMF metafiles, etc.) across countless applications, from Explorer thumbnailing to Office and browsers. The vulnerability is a CWE-122 heap-based buffer overflow, meaning attacker-controlled data in a malformed image causes GDI+ to write beyond an allocated heap buffer, corrupting adjacent heap structures and enabling control-flow hijack. Because GDI+ is invoked implicitly whenever affected image data is decoded, the vulnerable code path is reachable through many host applications rather than a single product. The CPE set confirms the defect lives in the OS-level Microsoft component shared by Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012/2012 R2/2016/2019/2022/2025.
RemediationAI
Apply the Microsoft security update for CVE-2026-50380 for each affected Windows SKU - Patch available per vendor advisory - using the per-version fixed builds listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50380; prioritize internet-exposed and user-facing systems and any host still on Windows Server 2012/2012 R2 (verify ESU coverage). Until patching completes, reduce exposure by blocking or stripping risky image and metafile attachments (EMF/WMF) at the mail gateway and web proxy, discouraging users from opening images from untrusted sources, and where feasible enabling attack-surface-reduction rules and rendering untrusted documents in sandboxed/Protected View contexts - trade-offs are that gateway filtering can break legitimate image workflows and Protected View adds user friction. There is no reliable way to disable GDI+ itself since it underpins normal Windows rendering, so patching is the only complete fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Heap Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-43871
GHSA-9q7r-6hhw-m22r