Windows GDI+ CVE-2026-50380

Exploitation requires the victim to open or render an attacker-crafted malformed image or metafile that is processed by GDI+ (gdiplus.dll) - the UI:R metric means a user action such as opening a file, previewing a thumbnail, or loading web/document content is mandatory, which limits mass automated exploitation. No authentication or prior privileges are needed (PR:N), and attack complexity is low (AC:L), so any supported Windows build (Windows 10 1607-Windows 11 26H1, Windows Server 2012-2025) in default configuration is affected once the image is opened. The primary limiting factor is the need to lure a user into viewing the malicious content; there is no special non-default feature or configuration prerequisite beyond having the unpatched GDI+ component present.

The signals mostly align toward high priority: CVSS 9.6 with AV:N/AC:L/PR:N means low-complexity, unauthenticated, network-reachable exploitation, and S:C plus C:H/I:H/A:H indicates a scope change with total impact - consistent with a graphics-library flaw that can escape into a higher-privilege or broader context. The key limiting factor is UI:R: a user must open or view the malicious image, so this is not wormable on its own and typically arrives via phishing, malicious documents, web content, or file shares. There is no CISA KEV listing and no POC referenced in the provided data, so exploitation is not confirmed in the wild; EPSS was not supplied. This is a genuine critical-severity patch-now issue given GDI+'s ubiquity and the memory-corruption impact, but the required user interaction and absence of a public exploit temper the immediacy relative to a zero-click bug.

An attacker crafts a malformed image (or a document/web page embedding one) that triggers the GDI+ heap overflow, then delivers it via phishing email, a chat/file share, or a malicious website. When the victim opens or previews the file, gdiplus.dll parses the image and the overflow corrupts the heap, allowing the attacker to execute code in the victim's context. No public exploit is identified at time of analysis, but the low attack complexity makes weaponization plausible once details or a POC circulate.