Windows GDI CVE-2026-50387

Exploitation requires the attacker to already be authenticated on the target with low privileges and to be able to execute code locally (CVSS AV:L, PR:L), so this cannot be triggered remotely or by an unauthenticated actor - an initial foothold on the host is a hard prerequisite. No user interaction is needed (UI:N) and attack complexity is low (AC:L), meaning that once local code execution is available, no special timing, race, or victim action is required to invoke the vulnerable Windows GDI code path. The limiting factors that reduce real-world risk are the mandatory local access and existing (even if minimal) privileges; the scope is unchanged (S:U), and only supported Windows/Windows Server builds running the affected GDI component are exploitable, not the Office-for-Mac/Android SKUs listed in the CPE data.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a local, low-complexity attack requiring existing low-level privileges and no user interaction, with high confidentiality, integrity and availability impact - a classic local privilege-escalation profile rather than a remotely reachable flaw. No EPSS score, POC, or KEV entry was provided, so there is no evidence of active or imminent widespread exploitation at this time; this is a patch-on-schedule priority rather than an emergency, though GDI EoP bugs are historically attractive as the second stage of an exploit chain (paired with a separate initial-access or RCE bug) and have been weaponized in the past. The main uncertainty is the CPE list: it mixes Windows/Server builds with Office for Mac/Android products that cannot host Windows GDI, suggesting metadata noise - the Windows and Windows Server entries should be treated as the authoritative affected set. Overall real-world risk is moderate-to-notable because the affected component is ubiquitous, but the local-access requirement meaningfully limits blast radius compared to a network-facing vulnerability.

An attacker who has already gained a low-privileged foothold on a Windows host - for example through phishing, a compromised low-privilege service account, or an unprivileged local user - runs a crafted program that feeds malformed graphics data to GDI, triggering the stack-based buffer overflow. With no user interaction required and low attack complexity, the overflow corrupts kernel-mode stack memory to hijack execution and elevate to SYSTEM. No public exploit is identified at time of analysis, but GDI local EoP flaws are a common second stage in real-world intrusion chains.