Skip to main content

Severity by source

Vendor (microsoft) PRIMARY
9.6 CRITICAL
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
ENISA EUVD
HIGH
qualitative
CIRCL (temporal)
8.3 HIGH
cvss
vuln.today AI
9.6 CRITICAL

Network-reachable image parsing with no auth (AV:N/PR:N) but mandatory user open (UI:R); shared GDI+ component yields scope change (S:C) and memory-corruption RCE gives full C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 21:08 vuln.today
CVE Published
Jul 14, 2026 - 17:06 nvd
CRITICAL 9.6

DescriptionCVE.org

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Windows GDI+ (gdiplus) lets an unauthenticated network attacker run arbitrary code when a victim opens or renders a specially crafted image, via a heap-based buffer overflow (CWE-122). The flaw affects a broad range of supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). It carries a critical CVSS 9.6 with a scope-changed impact, but requires user interaction and currently has no public exploit identified at time of analysis.

Technical ContextAI

GDI+ (gdiplus.dll) is the Windows graphics subsystem library responsible for parsing and rendering image formats (JPEG, PNG, TIFF, EMF/WMF metafiles, etc.) across countless applications, from Explorer thumbnailing to Office and browsers. The vulnerability is a CWE-122 heap-based buffer overflow, meaning attacker-controlled data in a malformed image causes GDI+ to write beyond an allocated heap buffer, corrupting adjacent heap structures and enabling control-flow hijack. Because GDI+ is invoked implicitly whenever affected image data is decoded, the vulnerable code path is reachable through many host applications rather than a single product. The CPE set confirms the defect lives in the OS-level Microsoft component shared by Windows 10 (1607/1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012/2012 R2/2016/2019/2022/2025.

RemediationAI

Apply the Microsoft security update for CVE-2026-50380 for each affected Windows SKU - Patch available per vendor advisory - using the per-version fixed builds listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50380; prioritize internet-exposed and user-facing systems and any host still on Windows Server 2012/2012 R2 (verify ESU coverage). Until patching completes, reduce exposure by blocking or stripping risky image and metafile attachments (EMF/WMF) at the mail gateway and web proxy, discouraging users from opening images from untrusted sources, and where feasible enabling attack-surface-reduction rules and rendering untrusted documents in sandboxed/Protected View contexts - trade-offs are that gateway filtering can break legitimate image workflows and Protected View adds user friction. There is no reliable way to disable GDI+ itself since it underpins normal Windows rendering, so patching is the only complete fix.

CVE-2026-33824 CRITICAL POC
9.8 Apr 14

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

CVE-2026-56155 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

CVE-2026-32202 MEDIUM POC
4.3 Apr 14

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n

CVE-2026-49798 CRITICAL POC
9.3 Jul 14

Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve

CVE-2026-54128 HIGH POC
8.4 Jul 14

Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff

CVE-2026-50518 CRITICAL
9.8 Jul 14

Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr

CVE-2026-50655 HIGH POC
7.8 Jul 14

Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug

CVE-2026-54992 HIGH POC
7.8 Jul 14

Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component

CVE-2026-50489 HIGH POC
7.8 Jul 14

Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem

CVE-2026-50667 HIGH POC
7.0 Jul 14

Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c

CVE-2026-57092 CRITICAL
9.9 Jul 14

Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating

CVE-2026-56190 CRITICAL
9.8 Jul 14

Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary

Share

CVE-2026-50380 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy