EUVD-2026-56677
GHSA-89jx-4r2g-hggf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network delivery via crafted image requires no privileges; user must open or preview the file (UI:R); full C/I/A impact from successful heap overflow exploitation with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution is possible in Windows GDI+ across a broad range of Windows 10, 11, and Windows Server versions due to an integer overflow that leads to a heap-based buffer overflow (CWE-122). Network-based attackers with no privileges required can exploit this by delivering a crafted image or graphic file, requiring only that the victim open or preview the content. A vendor patch is available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Windows GDI+ (Graphics Device Interface Plus) is the Windows graphics subsystem responsible for rendering 2D vector graphics and processing image formats including JPEG, PNG, BMP, EMF, and WMF. An integer overflow or wraparound in the GDI+ parsing logic causes an undersized heap buffer to be allocated, which is subsequently overflowed when attacker-controlled data is written into it - a classic CWE-190 → CWE-122 chain, formally classified under CWE-122 (Heap-based Buffer Overflow) in this advisory. GDI+ is deeply integrated into Windows: it is invoked by the shell for thumbnail rendering, by Outlook for attachment preview, by legacy browser components, and by countless third-party applications - making the effective attack surface substantially wider than any single application. Affected platforms span Windows 10 through 11 across multiple feature update channels and Windows Server 2012 through 2025, as confirmed by EUVD-2026-56677.
RemediationAI
Apply the Microsoft security update via Windows Update or WSUS as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62822. Confirmed patched builds from EUVD-2026-56677 include: Windows 10 22H2 at 10.0.19045.7663, Windows 11 24H2 at 10.0.26100.9168, Windows 11 25H2 at 10.0.26200.9168, Windows 11 26H1 at 10.0.28000.2704, Windows Server 2025 at 10.0.26100.33296, Windows Server 2022 at 10.0.20348.5499, Windows Server 2016 at 10.0.14393.9418, Windows Server 2019 at 10.0.17763.9115, Windows Server 2012 at 6.2.9200.26279, and Windows Server 2012 R2 at 6.3.9600.23337. If immediate patching is not feasible, the following compensating controls reduce exposure: configure email security gateways to strip or sandbox image and document attachments before delivery (trade-off: may disrupt legitimate image-in-email workflows); disable the Windows Explorer preview pane to prevent automatic GDI+ invocation on file hover (trade-off: reduces file-browsing usability); and restrict user access to shared folders containing untrusted graphic content. None of these mitigations eliminate the attack surface, as GDI+ is invoked across many application paths beyond the file manager.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today