CVE-2026-27931: Information Disclosure in Windows GDI

The primary impact of CVE-2026-27931 is the potential for information disclosure. An attacker can exploit the out-of-bounds read to access memory regions outside the intended boundaries of the GDI component. This could expose sensitive data, such as user credentials, application data, or even kernel memory. While the attacker must be local to the system, the disclosed information can be used for further attacks, such as privilege escalation or data theft. The severity is considered medium due to the local access requirement.

1. Veröffentlicht2026-04-14
2. Geändert2026-05-12
3. EPSS aktualisiert2026-04-22

The primary mitigation for CVE-2026-27931 is to upgrade affected Windows systems to version 10.0.28000.1836 or later. Microsoft has released a security update specifically addressing this vulnerability. If immediate patching is not feasible, consider restricting access to GDI functionality where possible. While a WAF or proxy cannot directly prevent this vulnerability, they can help detect and block suspicious network traffic. After upgrading, confirm the fix by attempting to trigger the out-of-bounds read and verifying that information disclosure is prevented.