Windows GDI EUVD-2026-99936

Exploitation requires the victim to open or preview attacker-supplied content rendered by the Windows GDI subsystem (such as a crafted image, embedded font, or metafile/document) - this is the UI:R requirement and is the primary limiting factor. The attacker is remote and unauthenticated (PR:N, AV:N), and no non-default configuration is needed: default installations of all listed Windows and Windows Server editions are affected. The flaw yields only information disclosure (I:N/A:N), so it cannot alter data or crash the host on its own; realistic risk depends on social-engineering a user into opening the content and on the sensitivity of whatever memory happens to sit adjacent to the over-read.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, score 6.5) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw, but exploitation requires user interaction (UI:R) and the impact is confidentiality-only (I:N/A:N). All exploitation signals point low and are mutually consistent: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, the CVE is NOT listed in CISA KEV, and no public exploit code is indicated in the provided data - so there is no public exploit identified at time of analysis. The SSVC 'Automatable: no' aligns with the UI:R requirement, since the attack cannot be mass-automated without a victim opening attacker content. The one point of mild tension is CVSS C:H (high confidentiality impact) versus SSVC Technical Impact 'partial'; out-of-bounds reads in GDI typically leak bounded adjacent memory rather than guaranteeing disclosure of specific secrets, so the real-world confidentiality impact may sit below the C:H rating - treat C:H as an upper bound. Net assessment: a patch-on-normal-cycle vulnerability, useful mainly as an ASLR/info-leak primitive chained with a separate code-execution bug, rather than a standalone emergency.

An attacker crafts a malicious image, font, or document (metafile) and delivers it via email attachment, chat, or a web page. When the victim opens or previews the content, Windows GDI performs an out-of-bounds read while parsing it, and adjacent process memory is disclosed back to the attacker - potentially leaking pointers useful for defeating ASLR. No public exploit is identified at time of analysis, and the UI:R requirement means a user must actively open the content.