CVE-2026-50387

Windows GDI Elevation of Privilege Vulnerability

No known exploitation. EPSS puts it in the 24th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile24th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Microsoft Windows (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019) with updates applied.
For Microsoft Office 365 for Mac and Microsoft Office LTSC for Mac 2021/2024, confirm you are on 16.111.26071215.
For Microsoft Office for Android, confirm you are on 16.0.20228.20042.
For Windows 10, upgrade to one of the fixed builds: 10.0.14393.9339, 10.0.17763.9020, 10.0.19044.7548, or 10.0.19045.7548 (use the one that matches your Windows 10 version).
For Windows 11, upgrade to one of the fixed builds: 10.0.26100.8875, 10.0.26200.8875, or 10.0.28000.2269 (use the one that matches your Windows 11 version).
For Windows Server 2012, upgrade to 6.2.9200.26226.
Apply the vendor update from the Microsoft Security Response Center guidance for CVE-2026-50387, then re-check that the affected versions are fully updated.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-50387 is a Windows/Office-related flaw that can let a local attacker run code with higher privileges; you should worry if someone with local access can reach your devices, because it can lead to full system control.

CVE-2026-50387 is a stack-based buffer overflow in Windows GDI that can allow an authenticated/authorized local attacker to elevate privileges and execute arbitrary code with elevated rights on vulnerable Windows systems and affected Office clients.

If you're affected

Full device takeover
Compromised business email/documents
System instability or outage
Malware installation with admin rights

What is it

This is a security bug that can be triggered when Windows is handling graphics-related work (Windows GDI). If an attacker already has local access to your computer, the bug could let them gain higher privileges—meaning they could take more control of the device than normal user access would allow. Think of it like a weakness in a “door lock” inside the building that an insider (someone already on site) can exploit to get into restricted areas.

Who is affected

This matters to you if your business uses vulnerable Windows systems (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019) and if you run the listed Microsoft Office clients on those platforms. The key risk is tied to a local attacker: you should focus on devices where someone with authorized local access could be present (for example, a compromised or untrusted user account on an affected machine). This is primarily a risk when an attacker can already get local access on the device; default “internet-only” reachability is not established in the provided findings.

How urgent is it

This is RED because the vulnerability allows local privilege escalation—attackers who can get local access can potentially gain elevated rights and take control of the system. Microsoft has new guidance/patch activity, but CISA KEV is not listed in the provided findings, and there’s no confirmed dated public exploit report—so your best move is to patch now rather than wait for more evidence.

What to do — in detail

Confirm exposure

Inventory your endpoints and servers for these products: Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, plus Microsoft Office 365 for Mac / Office LTSC for Mac 2021 / Office LTSC for Mac 2024 / Office for Android.
For Windows: determine your exact Windows build/version so you can match it to the correct fixed build listed by Microsoft.
For Office: confirm your installed Office version/build.

Apply the fixed versions (match by your current branch)

Microsoft Office 365 for Mac: upgrade to 16.111.26071215
Microsoft Office LTSC for Mac 2021: upgrade to 16.111.26071215
Microsoft Office LTSC for Mac 2024: upgrade to 16.111.26071215
Microsoft Office for Android: upgrade to 16.0.20228.20042
Windows 10: upgrade to one of the fixed builds depending on your current release:
- 10.0.14393.9339
- 10.0.17763.9020
- 10.0.19044.7548
- 10.0.19045.7548
Windows 11: upgrade to one of the fixed builds depending on your current release:
- 10.0.26100.8875
- 10.0.26200.8875
- 10.0.28000.2269
Windows Server 2012: upgrade to 6.2.9200.26226

Where to get the patch

Use Microsoft’s official update guidance page for CVE-2026-50387: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50387

If patching is delayed (temporary containment)

Reduce the chance that an attacker can gain local access: review account access for who has local logon capability, and remove unnecessary local/admin rights.
Limit physical/remote access pathways to the affected machines (e.g., restrict who can sign in locally, and tighten device access controls).
If you can’t update immediately, prioritize patching for machines where untrusted users could obtain local access (shared workstations, contractors, kiosks, or endpoints with weaker monitoring).

After patching

Re-check versions/build numbers to confirm the system is on the fixed build.
Monitor for signs of account misuse or local compromise on endpoints that were not patched quickly (e.g., unusual logons, new local admin users, suspicious process activity).

Technical context

What it is

CVE-2026-50387 is a Windows GDI stack-based buffer overflow (CWE-121). The reported capability is local privilege escalation: an authorized local attacker can execute arbitrary code with elevated privileges.

How it’s triggered (mechanism)

A memory-handling bug in the Windows graphics subsystem (GDI) can be corrupted in a way that results in elevated execution when an attacker can run code or otherwise operate as an authorized user locally.

Exploitation status

The findings do not indicate CISA KEV listing, and no dated exploitation claim or public exploit code is provided in the supplied sources. However, press attention notes “new, reason: patch,” and the vulnerability is still treated as high priority due to the privilege escalation impact.

Risk considerations for businesses

Because the attack vector is local and depends on an authorized attacker having local access, the practical risk is highest on systems where user accounts may be abused or where attackers can obtain local execution rights (compromised accounts, insider threats, weak access controls).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 27 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-20Patch availablerecord updated
2026-07-16Record updated
2026-07-15Record updated
2026-07-14Publishedweakness classified, att&ck mapped, record updated, record updated
2026-06-25OpenVAS check added

Affected products

Microsoftcommercial · US
- 365 copilotSaaS ServiceOn-premCloud & SaaS / saas-application
- microsoft 365SaaS ServiceSaaSCloud & SaaS / saas-application
- office 2021Desktop AppOn-premConsumer Software / productivity
- office 2024Desktop AppOn-premConsumer Software / productivity
- Windows 10 Version 1607OSOn-premOperating Systems / windows
- Windows 11 Version 24H2OSOn-premOperating Systems / windows
- Windows Server 2012 (Server Core installation)OSOn-premOperating Systems / windows
- Windows Server 2016 (Server Core installation)OSOn-premOperating Systems / windows

And 30 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable