Windows GDI: Denial of Service through stack-based buffer overflow

Summary

Windows GDI, the Graphics Device Interface that Windows uses for 2D rendering, contains a stack-based buffer overflow (CWE-121). The flaw affects several supported Windows 10, Windows 11 and Windows Server versions, including Windows 10 1607, Windows Server 2016 and Windows Server 2012 R2. An unauthenticated attacker on the network can crash or hang affected systems without user interaction. According to the CNA score, the impact is limited to availability; confidentiality and integrity are not affected.

Affected

• Windows 10 Version 1607 (builds 10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (builds 10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (builds 10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (builds 10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (builds 10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (builds 10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (builds 10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (builds 10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (builds 10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 and Server Core installation (builds 6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 and Server Core installation (builds 6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (builds 10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612 or later (KB number unknown)
• Windows 10 Version 1809: 10.0.17763.9376 or later
• Windows 10 Version 21H2: 10.0.19044.7807 or later
• Windows 10 Version 22H2: 10.0.19045.7807 or later
• Windows 11 Version 23H2: 10.0.22631.7652 or later
• Windows 11 Version 24H2: 10.0.26100.9711 or later
• Windows 11 Version 25H2: 10.0.26200.9711 or later
• Windows 11 Version 26H1: 10.0.28000.3231 or later
• Windows 11 Version 26H2: 10.0.26300.9711 or later
• Windows Server 2012: 6.2.9200.26434 or later
• Windows Server 2012 R2: 6.3.9600.23470 or later
• Fixes are part of the October 2026 cumulative updates. Verify the exact KB numbers on MSRC, especially for Windows 10 Version 1607.

Workaround

Unknown. No workaround or mitigation was found in the available sources.

Exploitation

• No exploitation in the wild is known. The CISA SSVC assessment records exploitation as none.
• The CISA SSVC assessment rates the flaw as automatable.
• No public proof of concept was found in the searches performed.
• EPSS score: 0.01273.

Our recommendation

• Install the October 2026 security updates on all affected Windows systems, starting with Windows 10 1607, 1809 and Windows Server 2016 and 2019.
• Check whether Windows 10 Version 1607 still receives security updates in your environment, or whether Extended Security Updates apply.
• Identify hosts that are reachable from untrusted networks and prioritise them.
• Monitor for crashes or hangs of Windows systems and for new exploit reports.
• Verify the affected builds and KB numbers on the MSRC Security Update Guide before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-83860 msrc.microsoft.com
• VulnDB: CVE-2026-83860 analysis vuldb.com
• Vulners CVE list entry: CVE-2026-83860 vulners.com
• Vulners NVD entry: CVE-2026-83860 vulners.com
• OpenCVE: CVE-2026-83860 app.opencve.io
• SonicWall: Microsoft October 2026 security bulletin coverage www.sonicwall.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:43.