EUVD-2026-100061
GHSA-m959-xgff-79rv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted image/document to victim
-
ExploitVictim opens or renders file
-
ExecutionOverflow stack buffer in GDI+ parser
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the targeted user to open or render attacker-controlled content (a crafted image/document) that is parsed by Windows GDI+, as reflected by UI:R in the CVSS vector - there is no self-propagating or fully automatic path (SSVC Automatable=no). No authentication is required (PR:N), and the attack is network-deliverable (AV:N) against default Windows installations, since GDI+ is a built-in component. The primary limiting factor is the mandatory user interaction; realistic risk is therefore tied to social-engineering success (opening email attachments, web content, or shared files). Affected builds span a broad range of Windows client and server versions (e.g., Windows 10 21H2/22H2, Windows 11 23H2-26H2, Windows Server 2012 through 2025, including Server Core); systems patched to the fixed builds listed in EUVD are not exploitable. |
| Impact | This is a genuinely high-priority patching item despite no evidence of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug (CWE-121 stack overflow) in Windows GDI+ that yields total confidentiality/integrity/availability impact - i.e., remote code execution. The only brake on the raw score is UI:R: a user must open or render a malicious image/document. CISA SSVC moderates urgency: Exploitation=none (no observed in-the-wild activity), Automatable=no (consistent with UI:R - it cannot self-propagate without a victim action), but Technical Impact=total (consistent with C:H/I:H/A:H). No EPSS score was provided in the input, and there is no KEV listing and no POC indicator, so exploitation is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: a high technical-impact, highly-prevalent flaw that is not yet weaponized and requires user interaction. Prioritize it because GDI+ is ubiquitous and historically a frequent, reliable RCE target, but it is not an emergency-override (no KEV, no POC, Automatable=no). |
| Exploit ScenarioDerived | An attacker crafts a malformed image or document that triggers the stack-based overflow when GDI+ parses it, then delivers it via email, a web page, a chat link, or a shared file. When the victim views or opens the content, GDI+ overflows a stack buffer and the attacker executes code in the user's security context. No public exploit code was identified at the time of analysis, and successful exploitation requires the victim's interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Stack-based buffer overflow in Microsoft GDI+ enables remote code execution in the security context of the current user when a crafted image or document is opened or rendered by the victim. The flaw is remotely deliverable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but exploitation hinges on mandatory user interaction - CISA's SSVC assessment records Exploitation as "none" and Automatable as "no", and no public exploit code has been identified at time of analysis, so there is no confirmed actively exploited (CISA KEV) activity. Because GDI+ is a built-in Windows component, the affected surface spans a very broad estate - Windows 10 21H2/22H2, Windows 11 23H2 through 26H2, and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - making this a high-priority patching item on patch-Tuesday cadence rather than an emergency response, with vendor patches already available. CISA SSVC nonetheless rates the technical impact as "total," reflecting the potential for full confidentiality, integrity and availability compromise on an unpatched host.
RemediationAI
Apply the Microsoft monthly security update that addresses CVE-2026-83934 - vendor-released patches are available - and prioritize by exposure: internet-facing and multi-user systems first, with the exact fixed builds from the EUVD data such as Windows 11 24H2/25H2 to 10.0.26100.9711 / 10.0.26200.9711, Windows 11 23H2 to 10.0.22631.7652, Windows 11 26H1 to 10.0.28000.3231 and 26H2 to 10.0.26300.9711, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 10 1607 to 10.0.14393.9612 and 1809 to 10.0.17763.9376, Windows Server 2022 to 10.0.20348.5761, Windows Server 2019 to 10.0.17763.9376, Windows Server 2016 to 10.0.14393.9612, Windows Server 2025 to 10.0.26100.33650, Windows Server 2012 to 6.2.9200.26434 and Windows Server 2012 R2 to 6.3.9600.23470. Guidance and detection details are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83934 and https://nvd.nist.gov/vuln/detail/CVE-2026-83934. There is no supported way to uninstall or globally disable GDI+, since the shell, imaging APIs and most document applications depend on it, so compensating controls must be layered while patching is staged: block image and document attachments at the mail gateway and enforce Attachment Manager/Mark-of-the-Web so untrusted files open in Protected View or Application Guard (trade-off: increased user friction and occasional false positives on legitimate business documents); run browsers and Office with exploit-protection mitigations such as Control Flow Guard, Arbitrary Code Guard and Data Execution Prevention enabled and consider Windows Defender Exploit Guard's stack-protection and ROP mitigations for the applications that decode images (trade-off: per-app tuning effort and potential compatibility issues with legacy plug-ins); restrict SMB/network share read access so untrusted users cannot stage crafted images in shared folders that other users open (trade-off: requires share-level ACL review and may disrupt collaboration workflows); and, where feasible, standardize on non-GDI+ decoding paths for high-risk workflows and reduce interactive user privileges via least-privilege and standard-user accounts so a successful overflow yields only user-level rather than administrative code execution (trade-off: elevation prompts increase helpdesk load). Note explicitly that absence of observed exploitation must not be read as proof the flaw is unexploitable - SSVC Automaatable is "no" and Exploitation is "none" only because no campaign has been observed to date, not because the bug is difficult to trigger once a victim opens the crafted file.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GDI+ is the native Windows graphics rendering subsystem that parses and rasterizes image and vector formats such as JPEG, PNG, GIF, TIFF, BMP, WMF and EMF on behalf of the shell, Office, browsers, imaging APIs and countless third-party applications; it is loaded by default and requires no optional service to be enabled. The root cause is CWE-121, a stack-based buffer overflow: a length or index derived from attacker-controlled image or document metadata is used without adequate bounds validation when copying data into a fixed-size stack buffer inside the GDI+ parser, corrupting saved registers and the return address and allowing an attacker to redirect execution - in the most common case to a controlled heap spray or ROP chain - when the malformed content is decoded. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms network-deliverable, low-complexity, unauthenticated exploitation with only user interaction as the prerequisite, and impact confined to the vulnerable component (Scope: Unchanged) but with high confidentiality, integrity and availability loss within the user's context. In practice, the attacker does not need to reach a listening service: delivery is via a malicious attachment, a web page rendered by an application that uses the GDI+ decoding path, a shared file or an embedded image in an Office document, and system-level compromise or credential theft follows only if the victim runs with elevated privileges. The high resource requirements GDI+ image parsing imposes and the absence of an Automatable SSVC rating are consistent with the assessment that remote scanning or mass self-propagation is not feasible - success depends on social engineering the target into rendering the file.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-deliverable, low-complexity memory corruption needing no auth (PR:N) but requiring the victim to open content (UI:R); RCE yields full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Microsoft GDI+, a core Windows component, has a high-severity flaw that could let an attacker run code with a user's privileges when a crafted image or document is opened, affecting a wide range of Windows endpoints and servers. The vulnerability is remotely deliverable and unauthenticated but requires user interaction, and no public exploit identified at time of analysis. Leadership should treat this as a high-priority patching item because it touches most of the Windows estate, but not as an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB