Microsoft Windows GDI: Remote Code Execution through out-of-bounds write

Summary

A out-of-bounds write in the Windows Graphics Device Interface (GDI) allows an unauthorized attacker to execute code remotely. The flaw affects several supported and older Windows 10, Windows 11 and Windows Server versions. Exploitation requires a victim to take an action, such as opening a crafted file or web content, which limits the practical risk.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9612
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9376
• Windows 10 Version 21H2: builds before 10.0.19044.7807
• Windows 10 Version 22H2: builds before 10.0.19045.7807
• Windows 11 Version 23H2: builds before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2, and Windows 11 Version 26H2: builds before 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 Version 26H1: builds before 10.0.28000.3231
• Windows Server 2012 R2 (including Server Core): builds before 6.3.9600.23470

Note: the CNA record lists Server 2012 R2, but some third-party databases differ. Verify against the MSRC advisory.

Fixed in

• Microsoft security update for each affected build (fixed builds per the NVD mirrors: 10.0.14393.9612, 10.0.17763.9376, 10.0.19044.7807, 10.0.19045.7807)
• Unknown: the KB number for Windows 10 Version 1607 and Windows Server 2016. Check the MSRC advisory.
• Distribution: Windows Update or the Microsoft Update Catalog

Workaround

• No vendor-published workaround found.
• Unknown: whether Microsoft offers a registry or configuration mitigation. Check the MSRC advisory.

Exploitation

• Microsoft's CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• VulDB reports no available exploit. Not listed in the CISA KEV catalog.
• No reports of in-the-wild exploitation or public proof-of-concept code were found in the research. This does not prove absence.
• EPSS about 0.006 (low predicted exploitation probability).

Our recommendation

• Install the Microsoft security update on all affected systems, prioritizing hosts that process untrusted documents, images or web content.
• Replace Windows 10 Version 1607 and Windows Server 2016 systems that are no longer supported, or confirm they still receive security updates. Unverified research notes indicate that extended support for Enterprise LTSB 2016 may end on 13 Oct 2026; check Microsoft's lifecycle pages.
• Check whether older hosts are reachable from the internet or untrusted networks, and restrict inbound access.
• Monitor for unusual behavior on systems that handle graphics or file input.
• Review the MSRC advisory for the final KB numbers and any mitigations.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide (MSRC advisory, not retrieved) msrc.microsoft.com
• NVD mirror on Vulners vulners.com
• Microsoft MSCVE entry on Vulners vulners.com
• Rapid7 entry on Vulners vulners.com
• VulDB entry vuldb.com
• OpenCVE entry app.opencve.io
• Strix CVE entry www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:25.