Windows GDI+ EUVD-2026-73399

The attacker must hold a low-privileged authenticated account on the network or be in a position to deliver content to a user who does (PR:L). A local user must actively open, preview, or otherwise cause Windows GDI+ to render the malicious content (UI:R) - this can occur through document preview in File Explorer, opening an email attachment, or visiting a web page with embedded graphics. GDI+ must process the malformed input, which is default behavior across all affected Windows builds with no opt-out mechanism. Exploitation is limited by: the requirement for at least low-privilege authentication, the need for user interaction (though GDI+'s involvement in passive preview paths reduces this friction in practice), and the absence of a scope change (S:U) meaning post-exploitation impact is confined to the victim system's privilege boundary. Windows versions patched to or above the fixed build numbers listed in the MSRC advisory are not vulnerable.

The CVSS base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects a meaningful but not worst-case scenario: a low-privileged account and user interaction are required, preventing fully automated, unauthenticated exploitation. The full triad impact (C:H/I:H/A:H) is consistent with heap-based buffer overflow leading to arbitrary code execution at an elevated privilege level. No EPSS data or CISA KEV listing is present in the provided intelligence, and no public exploit code has been identified at time of analysis; these absences suggest the vulnerability is not currently being mass-exploited, though the enormous install base and the breadth of affected versions represent significant latent risk. The UI:R constraint is the primary exploitation barrier - but GDI+ is invoked by many passive rendering paths (email preview, Explorer thumbnail, Office document embed), which can reduce the meaningful friction of this requirement. The description labels this an 'integer underflow' while CWE-122 (Heap-based Buffer Overflow) is assigned; both are consistent with the same exploit chain (underflow → undersized allocation → overflow) and do not represent a conflict.

An attacker with a low-privileged domain account or guest access crafts a malicious image or embedded graphic file (e.g., EMF, WMF, or PNG) that encodes an integer value designed to underflow a size calculation inside GDI+. The file is delivered via email attachment, SharePoint link, or a web page with an embedded preview; when the victim user opens or previews the file, GDI+ processes the malformed input, triggering an undersized heap allocation that is subsequently overflowed to redirect execution to attacker-controlled code running at SYSTEM or an elevated privilege level. No public proof-of-concept code has been identified at time of analysis.