Windows: Information disclosure via out-of-bounds read in GDI

Summary

CVE-2026-83651 is an out-of-bounds read in the Windows Graphics Device Interface (GDI) that affects several Windows 10, Windows 11 and Windows Server 2012 builds, plus some Office for Mac and Android versions. An unauthorized attacker on the network can read memory outside the intended buffer and disclose information, with no privileges or user interaction required according to the CVSS vector in the CVE record. The impact is limited to confidentiality; the record does not describe code execution. The CVSS score differs between sources (7.5 in the input data, 6.5 in some secondary sources), so verify it in NVD.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2012: 6.2.9200.0 to < 6.2.9200.26434
• Office LTSC for Mac 2021 and 2024, Office 365 for Mac: versions below 16.114.26101123
• Office for Android: versions 16.0.1 to < 16.0.20430.20000

Fixed in

• Windows 10 Version 1607: 10.0.14393.9612 or later
• Windows 10 Version 1809: 10.0.17763.9376 or later
• Windows 10 Version 21H2 and 22H2: 10.0.19044.7807 / 10.0.19045.7807 or later
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2, 25H2 and 26H2: 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711 or later
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Office: see the Microsoft Security Update Guide for the fixed versions

KB numbers: Unknown.

Workaround

Unknown.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact partial
• Microsoft exploitability flag: unproven
• EPSS around 1 percent
• No public proof of concept and no KEV listing found in a limited search; this is not confirmation of absence.

Our recommendation

• Patch supported Windows and Office systems in the regular October 2026 update cycle.
• Replace or isolate Windows 10 Version 1607 systems; they are an older release and should be upgraded.
• Check whether any affected system is reachable from outside the network.
• Verify the CVSS score and the KB numbers in the MSRC Security Update Guide before final prioritization.
• Priority: medium.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-83651 msrc.microsoft.com
• Vulners NVD mirror: CVE-2026-83651 vulners.com
• Vulners CVE List / CNA data: CVE-2026-83651 vulners.com
• OpenCVE record: CVE-2026-83651 app.opencve.io
• Strix summary: CVE-2026-83651 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:50.