CVE-2026-62822

Think of Windows GDI+ as a part of Windows that helps handle certain graphics and related data. This flaw lets an attacker send a crafted set of data over the network that can make Windows do the wrong thing, which can lead to malicious code running on your computer—especially if the user is tricked into processing the content. If a business PC or server gets taken over, it can quickly lead to ransomware or data theft.

This matters if you run any of the affected Windows editions: Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025. The attack does not require attackers to authenticate, but it does require user interaction to be exploited. In practice, treat it as a risk when the vulnerable system is reachable from the network and attackers can get a user to interact with or process malicious content sent over the network.

This is RED because it enables remote code execution: attackers can send malicious network content that triggers code execution on your Windows machine. Even though user interaction is required and KEV does not list it, patching is still urgent because the impact (full compromise) is high and Microsoft has released fixed builds.

1. Identify exposure on your systems

   • Determine your exact OS version/edition and build number (e.g., Windows 10 vs Windows 11; Windows Server 2016/2019/2022/2025; and which “fixed in” build applies).
   • Confirm whether the system can be reached from the network and whether users can be tricked into interacting with externally supplied content (the findings indicate network access plus user interaction are required).

2. Confirm the installed update status

   • Check Windows Update history on each affected machine.
   • Ensure the machine is at or above the fixed build for its specific OS line listed by Microsoft for CVE-2026-62822.

3. Upgrade/patch to the fixed versions

   • Windows 10: fixed in 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, 10.0.19045.7663
   • Windows 11: fixed in 10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704
   • Windows Server 2016: fixed in 10.0.14393.9418
   • Windows Server 2019: fixed in 10.0.17763.9115
   • Windows Server 2022: fixed in 10.0.20348.5499
   • Windows Server 2025: fixed in 10.0.26100.33296

4. If patching is delayed (temporary containment)

   • Reduce network exposure for Windows components so fewer systems are reachable from untrusted networks.
   • Tighten controls that limit user interaction with untrusted content (for example, restrict content sources users commonly interact with, and prevent opening/processing unknown attachments or content).

5. What to monitor after applying the fix

   • Review Windows logs around the period of any suspicious activity for unusual app crashes or errors related to Windows graphics handling.
   • Watch for signs of follow-on compromise (new admin accounts, unexpected scheduled tasks, suspicious process creation) as part of your normal incident monitoring.

CVE-2026-62822 is a HIGH-severity Windows GDI+ Remote Code Execution issue (CWE-122 and CWE-190). Mechanism-wise, the findings describe network-delivered malicious data that triggers an integer error in Windows GDI+, which can then lead to remote code execution. Authentication is not required, but user interaction is required for exploitation, and the attack needs network access to the target.

KEV is not listed for this CVE, and there is no clear dated press exploitation claim in the provided findings. No public exploit code is on record in the findings. A prediction (EPSS) indicates low predicted likelihood and a flat trend, but because this item is assessed as RED by the system verdict, treat it as an active priority for patching.

Patch availability is confirmed via Microsoft’s MSRC update guide, with multiple fixed build numbers across Windows 10, Windows 11, and supported Windows Server versions. The PULSE finding notes new actor interest (Lazarus group) and “patch” related attention, which reinforces the need to remediate quickly.