CVE-2026-62890 – Windows GDI+ Elevation of Privilege Vulnerability

CVE-2026-62890 is a heap-based buffer overflow vulnerability in Windows GDI+. An authorized local attacker with low privileges could exploit the flaw to execute code and gain SYSTEM privileges. Successful exploitation could have a high impact on confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS Score: 7.8.

SEVERITY: Critical.

THREAT:
The primary threat is local privilege escalation through a heap-based buffer overflow in Windows GDI+. An attacker who already has low-level access could potentially elevate to SYSTEM privileges. The attack complexity is rated Low and no user interaction is required.

EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
CVE-2026-62890 is caused by a heap-based buffer overflow (CWE-122) in Windows GDI+. The attack vector is Local, with Low attack complexity and Low privileges required. No user interaction is necessary. Successful exploitation allows an authorized attacker to execute code locally and could result in SYSTEM privileges. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations and supported architectures. Exploitation requires local access and low privileges but no user interaction.

BUSINESS IMPACT:
Successful exploitation could turn limited local access into SYSTEM-level control. This could expose sensitive information, permit unauthorized system changes, and disrupt affected Windows systems, with high potential impacts to confidentiality, integrity, and availability.

WORKAROUND:
No mitigations or workarounds are identified. An official fix is listed as the remediation, so affected systems should receive the applicable security update.

URGENCY:
This vulnerability carries a Critical severity rating and can allow an attacker with low privileges to gain SYSTEM privileges without user interaction. Although exploitation is assessed as Less Likely and no active exploitation is identified, organizations should prioritize deployment of the official fix because successful exploitation could provide extensive control over affected systems.