EUVD-2026-56434
GHSA-63q3-2937-wf8v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only reach, low-privilege authenticated trigger, no integrity or availability impact - confidentiality disclosure only, consistent with GDI memory read.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally.
AnalysisAI
Windows GDI (Graphics Device Interface) exposes an out-of-bounds read flaw exploitable by any locally authenticated, low-privileged user across a broad span of Windows releases - from Windows 10 Version 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Successful exploitation yields high-confidence memory disclosure (C:H per CVSS), enabling an attacker to read memory contents beyond the intended GDI buffer boundary, potentially exposing credentials, session material, or cryptographic data. No public exploit code or active exploitation has been identified at time of analysis; however, the low attack complexity and extremely wide platform coverage make this a high-priority routine patch-cycle item.
Technical ContextAI
Windows GDI is the core Windows subsystem responsible for rendering graphical output for applications and the OS shell; it is active by default on all supported Windows desktop and server editions. CWE-125 (Out-of-bounds Read) identifies the root cause: the GDI subsystem fails to enforce correct memory boundary checks during a read operation, allowing a caller to access memory locations beyond the bounds of an allocated buffer. This class of defect typically arises from missing or off-by-one length validation when processing graphical primitives, metafiles, or font rendering data. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is reachable from user space by any low-privileged local process without requiring user interaction, with no scope change - the impact is contained within the GDI security boundary and does not inherently cross into other OS components. The tagging as 'Buffer Overflow' alongside CWE-125 may reflect internal triage language; the authoritative classification is an out-of-bounds read, not a write overflow.
RemediationAI
Apply Microsoft's vendor-released patches via Windows Update or the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65662. Confirmed fixed builds per EUVD-2026-56434 are: Windows 10 1607 → 10.0.14393.9418; Windows 10 1809/Server 2019 → 10.0.17763.9115; Windows 10 21H2 → 10.0.19044.7663; Windows 10 22H2 → 10.0.19045.7663; Windows 11 23H2 → 10.0.22631.7517; Windows 11 24H2/Server 2025 → 10.0.26100.9168 (desktop) / 10.0.26100.33296 (server); Windows 11 25H2 → 10.0.26200.9168; Windows 11 26H1 → 10.0.28000.2704; Server 2012 → 6.2.9200.26279; Server 2012 R2 → 6.3.9600.23337; Server 2016 → 10.0.14393.9418; Server 2022 → 10.0.20348.5499. For systems where immediate patching is operationally blocked, enforce least-privilege access by removing unnecessary local interactive or RDP accounts - this raises the bar from PR:L to no access at all, as GDI exposure requires an authenticated local session. Note that Windows Server 2012 and 2012 R2 are past end of extended support; organizations still running these versions should prioritize migration or confirm coverage under Microsoft's Extended Security Update (ESU) program.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today