EUVD-2026-22486Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser interaction required
-
DeliveryOpen malicious graphics file
-
ExploitGDI parser processes file
-
ExecutionOut-of-bounds read triggered
-
PersistSensitive memory disclosed
-
ImpactInformation extracted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.5 (Medium) with local attack vector and user interaction required reflects moderate real-world risk. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms this is a local unauthenticated attack requiring user interaction (UI:R), with high confidentiality impact (C:H) but no integrity or availability impact. The out-of-bounds read permits information disclosure but not code execution or system compromise. Lacking EPSS data, KEV status, or public exploit code, this does not qualify as an immediate critical priority. However, the breadth of affected versions (spanning Windows 10 through 11 and Server 2012 through 2025) and the availability of a vendor patch make this a standard operational patch candidate rather than an emergency. Organizations should prioritize patching in routine monthly patching cycles, particularly for systems where user-facing graphics rendering is common. The local + user interaction requirement significantly reduces attack surface compared to remote or local-without-interaction vulnerabilities. |
| Exploit ScenarioDerived | A local user opens a crafted graphics file (such as a specially formatted image or document with embedded GDI rendering instructions) in an application that uses GDI for rendering (e.g., image viewer, PDF reader, or web browser). The malicious file triggers an out-of-bounds read in GDI memory processing, causing the application to read sensitive data from adjacent memory regions. The attacker then extracts this disclosed information (potentially including encryption keys, authentication tokens, or other sensitive data) from application memory or crash dumps. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Out-of-bounds read in Windows GDI allows local unauthenticated attackers to disclose sensitive information with user interaction. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, all Windows 11 versions from 22H3 through 26H1, and Windows Server 2012 through 2025. No public exploit code or active exploitation has been confirmed; a vendor patch is available.
RemediationAI
Vendor-released patch available from Microsoft Security Response Center (MSRC) at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27930. Administrators should apply the cumulative security updates that increment build versions beyond the thresholds listed in the affected products section (for example, Windows 10 22H2 requires KB update to 10.0.19045.7184 or later; Windows Server 2025 requires 10.0.26100.32690 or later). Deploy via Windows Update, WSUS, or manual download from the MSRC advisory. No workarounds are available; patching is the only remediation. Prioritize systems where users interact with graphics-intensive applications or where multiple user sessions may process untrusted graphical content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 36 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Windows Graphics Device Interface (GDI) is a core Windows subsystem responsible for rendering graphics and managing device-independent graphics output. CWE-125 (out-of-bounds read) indicates that GDI processing logic fails to properly validate buffer boundaries before reading memory, allowing an attacker to access memory beyond intended allocation limits. This is distinct from a write-based buffer overflow; the vulnerability permits information disclosure rather than code execution. The affected versions span multiple Windows 10 release branches (1607, 1809, 21H2, 22H2), Windows 11 from launch (22H3) through current versions (26H1), and legacy/current server editions (Server 2012 R2 through Server 2025), indicating the flaw exists in shared GDI code common across all these builds.
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
GitHub PoC
Exploit-DB