Windows GDI EUVD-2026-99411

Exploitation requires the target user to open or preview an attacker-supplied file (UI:R) that reaches the Windows GDI graphics parsing path - typically a crafted image or document delivered by email, web, or file share. No authentication is required (PR:N) and no special non-default configuration is indicated, since GDI is a core component present in default Windows installations. The primary limiting factor is the mandatory user interaction: there is no zero-click vector, which is corroborated by SSVC Automatable=no. Successful code execution runs in the context/privilege of the user who opens the file, so impact is bounded by that user's rights (S:U, no privilege scope change). Patch all listed builds across Windows 10/11, Server 2012 through Server 2025 to the fixed versions from MSRC.

This is a genuine high priority, though not an emergency. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity, unauthenticated heap overflow (CWE-122) yielding full confidentiality, integrity, and availability impact - i.e. remote code execution. However, the vector requires user interaction (UI:R), which materially lowers real-world exploitability versus a zero-click bug. The signals are consistent and currently point AWAY from active mass exploitation: CISA SSVC lists Exploitation=none and Automatable=no (consistent with the UI:R requirement that defeats worm-like automation), while Technical Impact=total aligns with the C:H/I:H/A:H RCE. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is not provided in the input. Net: a serious RCE in an ubiquitous component that warrants prompt patching, but the need for user interaction and the absence of known exploitation make it a priority-patch item rather than a drop-everything emergency. One caveat: the description says 'over a network' yet GDI flaws are typically triggered by opening a crafted file/document, which is why UI:R is set - verify the delivery assumption with Microsoft's advisory.

An attacker crafts a malicious image or document containing a specially formed GDI object and delivers it via email, web download, or a network share. When the victim opens or previews the file, the heap-based buffer overflow in Windows GDI is triggered, allowing the attacker to execute arbitrary code in the victim's user context. No public exploit code has been identified at time of analysis, and exploitation requires that user interaction.