Windows GDI CVE-2026-65662

Exploitation requires an authenticated local session with at minimum low-privilege access (PR:L per the provided CVSS vector, AV:L). The attacker must be able to invoke Windows GDI API calls, which is possible for any standard interactive user, Remote Desktop session user, or process running under a low-privileged service account - no special configuration or elevated role is needed, as GDI is a default active component on all affected Windows versions. Exploitation is strictly local (AV:L): a remote, unauthenticated attacker cannot directly reach the GDI subsystem without first establishing a local session through another vector. No user interaction by a third party is required (UI:N). Scope is unchanged (S:U), meaning the flaw does not by itself cross privilege or security boundaries to impact other OS components. Limiting factors for defenders: remote network accessibility is zero; local account creation or compromise is a prerequisite; and Server Core installations reduce the interactive attack surface compared to full GUI deployments.

The CVSS 5.5 medium rating is well-calibrated for this vulnerability: the local-only attack vector (AV:L) eliminates direct remote exploitation, and low-privilege authentication (PR:L) means an attacker must already have a foothold on the target system. No EPSS data was supplied, and this CVE does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code was referenced. Despite the constrained attack surface, the high confidentiality impact (C:H) is operationally significant - leaked GDI memory could feed a credential-harvesting or lateral-movement chain in a multi-stage intrusion. The breadth of affected platforms spanning nearly 14 years of Windows releases (Server 2012 through Server 2025, Windows 10 through 11 26H1) amplifies aggregate exposure: even a mid-sized municipal IT team in sanok managing a heterogeneous Windows estate would encounter multiple affected versions simultaneously. The low attack complexity (AC:L) means that once an attacker achieves local access, exploitation requires no special knowledge or race-condition timing. Overall assessment: routine but broad patch priority, not an emergency - local access dependency significantly limits real-world attacker leverage compared to network-reachable flaws.

An attacker who has obtained a low-privileged local session - via phishing, credential stuffing, or an earlier stage of a multi-step intrusion - submits a specially crafted GDI rendering call (such as a malformed metafile, font, or bitmap operation) that causes the GDI subsystem to read memory beyond the intended buffer boundary. The out-of-bounds read returns adjacent heap or kernel-adjacent memory contents that the attacker captures and analyzes offline, potentially recovering in-memory credentials, session tokens, or encryption keys for use in lateral movement. No public proof-of-concept has been identified, but the low attack complexity (AC:L) indicates no sophisticated technique beyond a crafted API call is required.