CVE-2026-49796

Windows GDI+ Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile38th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your organization runs any of these systems: Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025.
For each affected system, determine the exact Windows build/version number.
Update Windows to the fixed version for your platform branch (see the “fixed in” versions below) and reboot if your update process requires it.
If you cannot update immediately, reduce risk by preventing users from opening unknown or unsolicited files/images and blocking external content downloads where possible.
After updating, monitor for abnormal crashes and new suspicious activity on endpoints that handled external content.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

This is a Windows bug where specially crafted content can make Windows GDI+ crash or run code on your PC when you interact with it; if you’re using the listed Windows versions and handle documents/images from others, you should act to update.

CVE-2026-49796 is a heap-based buffer overflow in Windows GDI+ that can be triggered via user interaction with specially crafted content, leading to local arbitrary code execution on affected Windows 10/11 and Windows Server versions without needing authentication.

If you're affected

Local device takeover
Malware execution after browsing
Business disruption and downtime
Credential theft risk

What is it

Windows GDI+ is a built-in component Windows uses to handle graphics—like when you open images or other content. This bug is a memory-safety flaw that can be hit when a user interacts with specially crafted content, allowing code to run on the local machine. Think of it like a “dangerous file” that can trick the graphics viewer into executing attacker instructions when you view it.

Who is affected

This matters if your small business uses any of these operating systems: Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025. The bug does not require authentication, but it requires local access plus user interaction with malicious content, which is most realistic when employees open files or view images from email, messaging, or the web. Reachability is therefore mainly about whether an attacker can get a user to interact with crafted content on a vulnerable endpoint.

How urgent is it

This is a RED issue because it can lead to local arbitrary code execution on real Windows endpoints when a user interacts with malicious content. Even though we don’t have clear evidence of exploitation being widely reported in the provided sources, the impact is high (code execution locally) and it affects multiple supported Windows 10/11 and Windows Server releases, so patching should be treated as urgent.

What to do — in detail

Confirm exposure

Identify which endpoints run: Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025.
On each endpoint, record the OS version/build (for example, from Windows “System” settings or your endpoint management inventory).
Compare your build to the fixed versions below for your product branch.

Apply fixes (target versions)

Upgrade Windows to a version at or above the fixed builds for the matching OS:

Windows 10: fixed in 10.0.14393.9339, 10.0.17763.9020, 10.0.19044.7548, 10.0.19045.7548
Windows 11: fixed in 10.0.26100.8875, 10.0.26200.8875, 10.0.28000.2269
Windows Server 2012: fixed in 6.2.9200.26226
Windows Server 2012 R2: fixed in 6.3.9600.23291
Windows Server 2016: fixed in 10.0.14393.9339
Windows Server 2019: fixed in 10.0.17763.9020
Windows Server 2022: fixed in 10.0.20348.5386

Upgrade notes

After installing the update that brings the system to the fixed build, reboot if prompted or if your update policy requires it (memory-safety fixes typically need the updated components loaded).
Validate post-update by re-checking the OS build number.

Workarounds if you can’t patch immediately

Treat external files/images as untrusted: restrict opening unknown or unsolicited content.
Reduce “drive-by” exposure: limit users’ ability to download and open content from untrusted sources.
If you use web/email gateways, ensure they’re in place to filter suspicious content.

What to monitor after remediation

Endpoint crashes or repeated failures in the graphics rendering/viewing process.
Any unusual process launches shortly after a user opened external content.
Security alerts from your antivirus/EDR (if present) on affected hosts.

KEV timing

This CVE is not listed in the CISA KEV catalog per the provided findings.

Technical context

What’s happening

CVE-2026-49796 is a heap-based buffer overflow in Windows GDI+ (CWE-122). The attack requires user interaction with specially crafted content; authentication is not required.

How it’s triggered

A local attacker scenario is implied by the findings: the attacker needs local access to the vulnerable system and then relies on a user to interact with content that triggers the overflow in GDI+.

Impact

Successful exploitation can result in arbitrary code execution locally, which can allow full compromise of the affected endpoint (confidentiality, integrity, and availability impacts are consistent with the described capability).

Exploitation status

CISA KEV: not listed.
Public exploit code: none reported in the provided findings.
Press reporting: no clear dated claim or direct article mention in the provided findings.

Priority rationale (RED)

Even without confirmed KEV listing or public exploit code in the provided sources, the combination of a memory corruption flaw in a widely used Windows component (GDI+) and the stated capability (execute arbitrary code locally) makes patching critical across affected Windows 10/11 and Windows Server versions.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 27 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-16Patch availablerecord updated, record updated
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated
2026-06-25OpenVAS check added

Affected products

Microsoftcommercial · US

And 22 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable