Windows GDI+ EUVD-2026-56632

Exploitation requires an existing local session on the target system with at minimum a standard (low-privileged) user account, as confirmed by CVSS AV:L and PR:L. No network reachability to the GDI+ subsystem is possible - an attacker must first obtain local code execution or an interactive login. No special non-default configuration is required; GDI+ is active by default on all listed Windows builds. Exploitation is not automatable per CISA SSVC, meaning it cannot be reliably weaponized for mass lateral-movement scripts. The key limiting factors are: (1) requirement for an existing local or RDP session, (2) no cross-network reach, and (3) impact is read-only - no writes or crashes. These factors make this vulnerability most dangerous in shared-access environments (terminal servers, VDI) where untrusted users share a host with privileged sessions.

The CVSS 5.5 Medium score is appropriate and not under-stated for this vulnerability class. The local-only attack vector (AV:L) is the primary risk limiter - an attacker must already have an interactive or scripted session on the target system, meaning this cannot be triggered remotely without a separate initial-access vector. CISA SSVC independently confirms exploitation=none and automatable=no, aligning with AV:L and reinforcing that mass internet exploitation is not feasible. Technical impact is rated partial by SSVC, consistent with C:H/I:N/A:N in the CVSS vector. Despite the medium score, the C:H rating is meaningful: GDI+ operates across user and system contexts, and uninitialized memory in this subsystem could contain credentials, tokens, or sensitive rendering data from co-resident processes. In multi-user environments (RDP servers, Citrix/VDI, terminal services), a low-privileged tenant could leverage this to access memory belonging to a higher-privileged co-located session. In single-user workstations, real-world risk is substantially lower. No KEV listing, no public exploit, and SSVC exploitation=none collectively indicate this is a patch-cycle priority rather than an emergency response item.

A low-privileged user with an active RDP session on an unpatched Windows Server 2019 terminal server invokes a GDI+-backed rendering operation - such as opening an image or triggering a graphical UI element - causing the subsystem to return a buffer containing uninitialized memory. The attacker reads the leaked bytes and parses them for session tokens, password fragments, or other sensitive residual data from co-resident privileged sessions. No public exploit exists at time of analysis, but the low attack complexity (AC:L) suggests the trigger is a straightforward API call rather than a complex heap-grooming technique.