CVE-2026-62822 – Windows GDI+ Remote Code Execution Vulnerability

CVE-2026-62822 is a Critical Windows GDI+ remote code execution vulnerability caused by an integer overflow or wraparound and a heap-based buffer overflow. An unauthorized remote attacker can exploit the vulnerability by convincing a user to open a specially crafted file. Successful exploitation can execute code on the affected system, with potentially high impact to confidentiality, integrity, and availability.

CVSS Score: 8.8.

SEVERITY: Critical.

THREAT:
The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation can result in remote code execution with high confidentiality, integrity, and availability impact.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY:
The vulnerability affects Windows GDI+ and involves integer overflow or wraparound and heap-based buffer overflow conditions. An attacker can remotely deliver a specially crafted file, but exploitation requires the user to open that file. The attack vector is network-based, attack complexity is low, and no privileges are required. Successful exploitation allows unauthorized remote code execution in the target context and can have high impact on the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation requires a user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an affected Windows system, potentially exposing sensitive information, enabling unauthorized system changes, or disrupting system availability. Because no attacker privileges are required and attack complexity is low, malicious-file delivery presents a significant organizational risk even though user interaction is required.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the identified remediation.

URGENCY:
This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with high confidentiality, integrity, and availability impact. Although it is not publicly disclosed or known to be exploited and exploitation is assessed as Less Likely, affected Windows systems should be prioritized for patching because exploitation requires no attacker privileges and has low attack complexity.