Windows GDI EUVD-2026-99444

Exploitation requires the victim to open or render an attacker-crafted file processed by Windows GDI (the vector is AV:N/AC:L/PR:N but UI:R), so the mandatory limiting factor is user interaction - there is no zero-click or fully automated path, which is consistent with SSVC Automatable=no. No authentication or elevated privileges are needed on the attacker side (PR:N), and the scope is unchanged (S:U), meaning code runs in the context of the interacting user rather than automatically at SYSTEM. Affected deployments are Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 R2/2016/2019/2022/2025 below the fixed build numbers listed by EUVD; systems patched to or above those builds are not exploitable.

This is a genuine high-priority patch item, though not an emergency at the time of analysis. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity, unauthenticated memory-corruption flaw with total impact to confidentiality, integrity, and availability - consistent with CWE-787 out-of-bounds write enabling code execution. The one factor that meaningfully tempers raw severity is UI:R: successful exploitation requires a user to interact (typically opening or rendering a malicious file/image), so this is not a wormable, zero-click issue. CISA's SSVC framework reinforces a measured posture: Exploitation=none (no observed exploitation or public PoC), Automatable=no (consistent with the user-interaction requirement defeating mass automation), but Technical Impact=total (matching the C:H/I:H/A:H full-system compromise potential). No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. There is NO CISA KEV listing and NO public exploit identified. Signals are therefore internally consistent - high technical impact paired with a real interaction barrier and no evidence of in-the-wild use - pointing to 'patch promptly as part of normal cycle' rather than 'drop everything.' Given that Windows GDI is a historically favored and heavily weaponized attack surface, the window between patch and real-world exploit development is often short, so prompt remediation is warranted.

An attacker crafts a malicious image or document that, when rendered by a vulnerable Windows GDI component, triggers an out-of-bounds write. The attacker delivers it via email, a web page, a chat message, or a file share and socially engineers the target into opening or previewing it, achieving code execution in the context of the user. No public exploit or PoC has been identified at time of analysis, and the required user interaction (UI:R) raises the practical bar for mass exploitation.