Windows GDI+ CVE-2026-62822

Exploitation requires that the victim user open or preview a crafted file processed by Windows GDI+ - such as a malformed JPEG, PNG, BMP, EMF, or WMF graphic - delivered via email, web download, or shared storage. The CVSS vector (AV:N/PR:N/UI:R) confirms network delivery without authentication is feasible, but UI:R means the attacker must induce user action; no unauthenticated zero-click path is confirmed. GDI+ is enabled by default across all affected Windows versions and invoked automatically by the Windows shell for thumbnail rendering and by Outlook for image previews - no non-default configuration is required to expose the vulnerable code path. Exploitation is limited by the requirement for user interaction, which prevents automated propagation; Windows heap mitigations such as ASLR and heap integrity checks may increase exploitation complexity in practice but do not prevent exploitation given a sufficiently crafted payload.

The CVSS 8.8 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high real-world risk: low attack complexity, no authentication required, and full confidentiality, integrity, and availability impact upon successful exploitation. The sole friction is the UI:R requirement - a victim must open or preview a malicious file - which prevents fully automated, worm-style propagation but is trivially overcome via phishing or watering-hole delivery. No EPSS data was provided in the input and therefore cannot be assessed. Given that GDI+ is a ubiquitous Windows component and the attack requires only social engineering of one user, even a mid-sized municipal IT team in koszalin should treat this as urgent and prioritize patch deployment before exploit code surfaces publicly. No KEV listing has been confirmed and no public exploit code has been identified at time of analysis, but the broad affected version range and the near-universal deployment of GDI+ across Windows environments make this a high-priority patching target regardless.

An attacker sends a specially crafted image file - such as a malformed JPEG or EMF graphic - to a target user on an unpatched Windows system via a phishing email or drive-by download. When the victim opens the file or previews it in the Windows Explorer preview pane, GDI+ parses the malformed content; the integer overflow causes an undersized heap allocation and attacker-controlled data overwrites adjacent heap memory, enabling arbitrary code execution in the context of the victim's user session. No public exploit code has been identified at time of analysis.