Microsoft Windows GDI: Information disclosure via out-of-bounds read
Summary
An out-of-bounds read in the Windows Graphics Device Interface (GDI) allows an unauthorized attacker to read small portions of heap memory over a network. The CVSS vector requires no privileges but user interaction, and the impact is limited to confidentiality. Microsoft rates exploitation as less likely, and no public exploit code is known.
Affected
- Windows 10 Version 1607 (builds before 10.0.14393.9688)
- Windows 10 Version 1809 (builds before 10.0.17763.9487)
- Windows 10 Version 21H2 (builds before 10.0.19044.7846)
- Windows 10 Version 22H2 (builds before 10.0.19045.7846)
- Windows 11 Version 23H2 (builds before 10.0.22631.7711)
- Windows 11 Version 24H2 (builds before 10.0.26100.9974)
- Windows 11 Version 25H2 (builds before 10.0.26200.9974)
- Windows 11 Version 26H1 (builds before 10.0.28000.3501)
- Windows 11 Version 26H2 (builds before 10.0.26300.9974)
- Windows Server 2016 incl. Server Core (builds before 10.0.14393.9688)
- Windows Server 2019 incl. Server Core (builds before 10.0.17763.9487)
- Windows Server 2022 (builds before 10.0.20348.5870)
Fixed in
- Fixed in the November 2026 security update (MSRC, released 10 Nov 2026)
- Windows 10 1607 / Server 2016: 10.0.14393.9688
- Windows 10 1809 / Server 2019: 10.0.17763.9487
- Windows 10 21H2: 10.0.19044.7846
- Windows 10 22H2: 10.0.19045.7846
- Windows 11 23H2: 10.0.22631.7711
- Windows Server 2022: 10.0.20348.5870
- Unknown: KB numbers, Windows 11 26H1 ARM64 build, and Windows 10 ESU details. Verify on the MSRC page before rollout.
Workaround
Unknown. No vendor workaround was found; install the November 2026 security update.
Exploitation
- Publicly disclosed: No
- Exploited: No
- Microsoft exploitability assessment: Exploitation Less Likely
- Not listed in CISA KEV
- No public proof of concept found as of 11 Nov 2026
Our recommendation
- Install the November 2026 Windows security update on all affected systems, prioritising Windows 10 systems on Extended Security Updates
- Check patch status of Windows Server 2016, 2019 and 2022 systems
- Verify the exact fixed builds on the MSRC page before deployment
- Monitor for reports of exploitation and public exploit code, as this CVE is only recently published
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – Windows GDI
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-108424 msrc.microsoft.com
- CVE Record: CVE-2026-108424 www.cve.org
- OffSeq Radar: CVE-2026-108424 radar.offseq.com
- Strix: CVE-2026-108424 www.strix.ai
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:36.
Original description (NVD)
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.