Windows GDI EUVD-2026-99509

Exploitation requires that a vulnerable Windows GDI code path parse attacker-supplied graphics/image data; Microsoft rates it as remote, unauthenticated, and interaction-free (AV:N/PR:N/UI:N), implying no special configuration beyond an unpatched system. The practical limiting factor is that impact is confined to disclosure of process memory (C:H, I:N, A:N) with no code execution or tampering, so value to an attacker is primarily as an ASLR-bypass or reconnaissance primitive feeding another exploit. A likely real-world constraint not reflected in the vector is that the target process must actually render attacker-controlled content through GDI, which in many deployments depends on a service or user action handling that data.

Signals are consistently moderate and point AWAY from this being a top-priority emergency despite the 7.5 'High' CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, no-interaction network vector, which looks severe in isolation, but impact is confined to confidentiality only (C:H/I:N/A:N) - this is an information-disclosure (out-of-bounds read) bug, not RCE. The EPSS score is low in absolute terms (0.93% probability of exploitation in 30 days) even though its 60th percentile ranking sounds mid-range; percentile and probability disagree because most CVEs score far lower, so a sub-1% probability is the dominant signal. CISA's SSVC decision framework corroborates low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis. One point to verify with the vendor: GDI graphics-parsing flaws typically require the target to process attacker-supplied image/document data, yet Microsoft rates this UI:N/AV:N (fully remote, no interaction) - if the real-world trigger requires a user to open crafted content, practical exploitability is lower than the vector implies. Net: patch on a normal cadence; this is a defense-in-depth memory-disclosure issue, not a drop-everything priority.

A remote attacker supplies specially crafted graphics/image data that a Windows service or application renders through the vulnerable GDI code path, triggering an out-of-bounds read. The leaked adjacent memory could contain pointers or secrets usable to defeat ASLR or stage a follow-on exploit. No public exploit code has been identified, and exploitation yields only information disclosure (no code execution or modification on its own).