Microsoft Windows GDI: Remote code execution via heap-based buffer overflow

Summary

A heap-based buffer overflow in the Windows Graphics Device Interface (GDI) allows an unauthenticated remote attacker to execute code. Exploitation requires that a user interacts with a crafted file or content, the exact trigger is not described in the sources. Successful exploitation would give the attacker full control over the affected system, as the CVSS impact is high for confidentiality, integrity and availability.

Affected

• Windows 10 Version 1607: below 10.0.14393.9612
• Windows 10 Version 1809: below 10.0.17763.9376
• Windows 10 Version 21H2: below 10.0.19044.7807
• Windows 10 Version 22H2: below 10.0.19045.7807
• Windows 11 Version 23H2: below 10.0.22631.7652
• Windows 11 Version 24H2: below 10.0.26100.9711
• Windows 11 Version 25H2: below 10.0.26200.9711
• Windows 11 Version 26H1: below 10.0.28000.3231
• Windows 11 Version 26H2: below 10.0.26300.9711
• Windows Server 2012 and 2012 R2 (including Server Core): below 6.2.9200.26434 and 6.3.9600.23470
• Windows Server 2016: below 10.0.14393.9612

Fixed in

Install the Microsoft security update for CVE-2026-70089 for the respective Windows version. The exact KB number for Windows 10 Version 1607 is unknown and must be taken from the MSRC advisory. Known: Windows 10 Version 21H2 uses KB5126657, Windows Server 2025 uses KB5126646, Windows 10 1809 and Server 2019 use KB5126651.

Workaround

Unknown. No workaround or mitigation was found in the sources.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• Not listed in the CISA KEV catalog
• Microsoft does not flag the vulnerability as exploited
• EPSS score 0.00837
• No public proof of concept found in the research, which does not prove that none exists

Our recommendation

• Identify all systems running the listed Windows versions, especially Windows 10 1607, 1809 and Windows Server 2012, 2012 R2 and 2016
• Verify the support status of Windows 10 1607 and plan an upgrade if support has ended
• Install the October 2026 security update as a priority, obtaining the correct KB number from the MSRC update guide
• Restrict exposure of unpatched systems and train users not to open untrusted files or content
• Monitor for unusual process activity on endpoints until patching is complete

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70089 msrc.microsoft.com
• NVD record mirrored on Vulners vulners.com
• Microsoft CVE record mirrored on Vulners vulners.com
• Strix CVE overview www.strix.ai
• OpenCVE entry app.opencve.io
• Senserva KB 5126657 senserva.com
• Rapid7 record on Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:57.