Windows GDI CVE-2026-77491

Exploitation requires a local user to open or preview a specially crafted file - such as a malicious image, font resource, or document containing embedded GDI content - that triggers the vulnerable GDI rendering path (this is the UI:R component). The CVSS vector specifies no privileges required (PR:N), so any standard unprivileged user account is a viable victim. The attack vector is local (AV:L), meaning the malicious file must be rendered on the local system; there is no known pure-network exploitation path. Exploitation is further bounded to Windows installations running builds below the per-version thresholds listed above; fully patched systems are not affected. No special or non-default Windows configuration appears to be required - any Windows installation that processes GDI content through the standard rendering pipeline is in scope.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) correctly characterizes this as a medium-severity local information disclosure. The high confidentiality impact (C:H) reflects that GDI memory reads can expose kernel pointers or heap addresses, making this useful as an ASLR-defeat primitive within a multi-stage attack chain - a threat model more serious than a simple data leak. However, the local attack vector (AV:L) and mandatory user interaction (UI:R) substantially limit standalone exploitability: a victim must actively open a malicious file. No CISA KEV listing and no public exploit code have been identified at time of analysis; EPSS score is not present in the available input data. The breadth of affected Windows versions (2012 through current) and the value of GDI leaks as enablers of privilege escalation chains elevate this above routine medium-severity issues, but it does not warrant emergency out-of-band patching. The 'Buffer Overflow' tag in the input metadata is technically inaccurate - CWE-125 is a read, not a write overflow - and should not influence triage decisions.

An attacker crafts a malicious image or document containing a specially formed GDI resource and delivers it via phishing email or a drive-by download. When the target user opens or previews the file on an unpatched Windows system, the GDI subsystem processes the malformed content and performs an out-of-bounds read, leaking heap or kernel address data into memory accessible to the renderer. The attacker, acting in a coordinated multi-stage attack, uses the leaked pointer values to defeat ASLR before launching a subsequent privilege escalation or code execution exploit. No public exploit code has been identified at time of analysis.