Windows GDI+ CVE-2026-62890

Exploitation requires a valid local account with at least standard (low-privilege) user rights, as confirmed by the CVSS vector PR:L. The attack vector is strictly local (AV:L) - this vulnerability cannot be triggered remotely over a network without prior local access or code execution. The attacker must be able to invoke or influence a GDI+ graphics operation on the vulnerable host, which is achievable through any standard application capable of rendering images or graphics. No special non-default configuration is required; GDI+ is present and active by default on all affected Windows versions. What limits exploitation: attackers without any local account or code execution on the target cannot reach the vulnerable code path; remote-only threat actors must first achieve initial access through a separate vector before this vulnerability becomes relevant.

The CVSS 3.1 base score of 7.8 is well-supported by the underlying metrics: AV:L confirms this is not remotely exploitable, but AC:L indicates exploitation is straightforward once the attacker has local access, and PR:L confirms only a standard user account is required - not administrative credentials. The full C:H/I:H/A:H impact triad means a successful exploit delivers complete system compromise. No EPSS data was included in the intelligence feed, and the vulnerability is not listed in the CISA KEV catalog as of this analysis, which modestly reduces near-term exploitation urgency compared to actively exploited GDI+ flaws seen historically. Even so, even a mid-sized municipal IT team in malbork should treat this as urgent given the extraordinary breadth of affected platforms - 19 Windows SKUs from Windows Server 2012 through the latest Windows 11 and Server 2025 releases - and the fact that low-complexity local privilege escalation flaws in core OS graphics subsystems are a well-understood and frequently weaponized attack class. No POC has been publicly identified, which is the primary factor preventing this from being assessed as critical-priority, but Microsoft's own reporting channel (secure@microsoft.com) was the source, suggesting internal discovery rather than coordinated disclosure after exploitation.

A low-privilege local user - such as a shared workstation user, RDP session user, or compromised service account - opens or processes a crafted graphics object or image that triggers the GDI+ heap overflow. The overflow corrupts adjacent heap metadata or function pointers, which the attacker leverages to redirect execution to shellcode or a ROP chain, ultimately running arbitrary code under an elevated context on the same host. No public POC has been identified at time of analysis, but the AC:L rating indicates the exploit primitive does not require complex heap grooming or race conditions to land reliably.