CVE-2026-27930: Information Disclosure in Windows GDI
Platform
windows
Component
windows-gdi
Fixed in
10.0.28000.1836
CVE-2026-27930 describes an information disclosure vulnerability within the Windows Graphics Device Interface (GDI). This flaw allows an unauthorized attacker to potentially expose sensitive information locally. The vulnerability impacts Windows versions 10.0.14393.0 through 10.0.28000.1836. Microsoft has released a security update to address this issue.
Impact and Attack Scenarios
The core impact of CVE-2026-27930 lies in the potential for local information disclosure. An attacker who can exploit this vulnerability could read data from memory regions they are not authorized to access. This data could include sensitive system information, user credentials, or other confidential data. While the vulnerability is described as local, it could be leveraged in scenarios where an attacker has already gained some level of access to the system, such as through a phishing attack or compromised account. The extent of the data exposed depends on the specific memory region accessed, but the potential for misuse is significant. Exploitation could lead to privilege escalation or further compromise of the system, depending on the nature of the disclosed information.
Exploitation Context
CVE-2026-27930 was published on April 14, 2026. As of the current date, there is no indication of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and its EPSS score is pending evaluation. Public proof-of-concept (POC) code is not currently available, suggesting a relatively low immediate risk of widespread exploitation.
Threat Intelligence
Exploit Status
EPSS
0.05% (14% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Local — attacker needs a local shell or interactive session on the system.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-27930 is to upgrade affected Windows systems to version 10.0.28000.1836 or later. If immediate patching is not feasible, consider implementing stricter access controls and monitoring system activity for suspicious behavior. While a direct workaround is not available, limiting user privileges and restricting access to sensitive resources can reduce the potential impact of a successful exploitation. Regularly review and update security policies to ensure they align with current threat landscape. After upgrading, confirm the fix by checking the Windows version number to ensure it is 10.0.28000.1836 or higher.
How to fix
Aplica las actualizaciones de seguridad proporcionadas por Microsoft para Windows 10. Estas actualizaciones corrigen una vulnerabilidad de divulgación de información en el componente GDI, previniendo que atacantes puedan acceder a información sensible en el sistema. Consulta el boletín de seguridad de Microsoft para obtener más detalles y las instrucciones de instalación.
Frequently asked questions
What is CVE-2026-27930 — Information Disclosure in Windows GDI?
CVE-2026-27930 is a medium severity vulnerability in Windows GDI allowing an attacker to disclose information locally through an out-of-bounds read. It affects Windows versions 10.0.14393.0 through 10.0.28000.1836.
Am I affected by CVE-2026-27930 in Windows GDI?
You are affected if you are running Windows 10 versions 10.0.14393.0 through 10.0.28000.1836. Check your Windows version using the 'ver' command in the command prompt.
How do I fix CVE-2026-27930 in Windows GDI?
Upgrade your Windows system to version 10.0.28000.1836 or later to remediate the vulnerability. Ensure automatic updates are enabled to receive future security patches.
Is CVE-2026-27930 being actively exploited?
As of the current date, there is no indication of active exploitation in the wild. Public proof-of-concept code is not currently available.
Where can I find the official Microsoft advisory for CVE-2026-27930?
Refer to the Microsoft Security Update Guide for CVE-2026-27930. The specific advisory URL will be available once the update is officially released.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...