CVE-2026-27931: Information Disclosure in Windows GDI
Platform
windows
Component
windows-gdi
Fixed in
10.0.28000.1836
CVE-2026-27931 describes an information disclosure vulnerability within the Windows Graphics Device Interface (GDI). This flaw allows an unauthorized attacker to potentially expose sensitive data locally. The vulnerability impacts Windows versions 10.0.19044.0 through 10.0.28000.1836, and a patch is available in version 10.0.28000.1836.
Impact and Attack Scenarios
The core impact of CVE-2026-27931 lies in the potential for local information disclosure. An attacker who can trigger this vulnerability could read data beyond the intended boundaries of memory within the GDI component. While the vulnerability is described as local, this means an attacker needs some level of access to the system to exploit it. The specific data exposed is unknown, but it could include sensitive system information, user data, or potentially even parts of other applications' memory. The severity is classified as medium, suggesting a moderate risk of exploitation given the need for local access and the potential impact of data exposure.
Exploitation Context
CVE-2026-27931 was published on April 14, 2026. As of the current date, there is no indication of active exploitation campaigns targeting this vulnerability. It is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog or has an EPSS score. Public proof-of-concept (POC) code is currently unavailable, which reduces the immediate risk of widespread exploitation.
Threat Intelligence
Exploit Status
EPSS
0.05% (14% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Local — attacker needs a local shell or interactive session on the system.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- High — complete confidentiality loss. Attacker can read all data: credentials, keys, personal data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-27931 is to upgrade affected Windows systems to version 10.0.28000.1836 or later, which includes the security patch. If immediate patching is not possible, consider implementing stricter access controls to limit the potential for local attackers to exploit the vulnerability. While there are no specific WAF or proxy rules that can directly address this vulnerability, ensuring that the GDI component is up-to-date is the most effective preventative measure. After upgrading, confirm the fix by verifying the Windows build version is 10.0.28000.1836 or higher using systeminfo command.
How to fix
Aplica las actualizaciones de seguridad proporcionadas por Microsoft para Windows 10. Estas actualizaciones corrigen una vulnerabilidad de divulgación de información en el componente GDI, previniendo que atacantes puedan acceder a datos sensibles en tu sistema. Asegúrate de instalar las últimas actualizaciones a través de Windows Update.
Frequently asked questions
What is CVE-2026-27931 — Information Disclosure in Windows GDI?
CVE-2026-27931 is a medium severity vulnerability in Windows GDI that allows an attacker to disclose information locally due to an out-of-bounds read. It affects Windows 10 versions 10.0.19044.0 through 10.0.28000.1836.
Am I affected by CVE-2026-27931 in Windows GDI?
You are affected if your system is running Windows 10 versions 10.0.19044.0 through 10.0.28000.1836. Check your version using the ver command.
How do I fix CVE-2026-27931 in Windows GDI?
Upgrade your Windows system to version 10.0.28000.1836 or later to receive the security patch. This is the primary and recommended mitigation.
Is CVE-2026-27931 being actively exploited?
As of the current date, there is no public evidence of active exploitation campaigns targeting CVE-2026-27931.
Where can I find the official Windows advisory for CVE-2026-27931?
Refer to the Microsoft Security Update Guide for the official advisory and details related to CVE-2026-27931.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...