CVE-2026-27931: Information Disclosure in Windows GDI
Platform
windows
Component
windows-gdi
Opgelost in
10.0.28000.1836
CVE-2026-27931 describes an information disclosure vulnerability within the Windows Graphics Device Interface (GDI). This flaw allows an unauthorized attacker to potentially expose sensitive data locally. The vulnerability impacts Windows versions 10.0.19044.0 through 10.0.28000.1836, and a patch is available in version 10.0.28000.1836.
Impact en Aanvalsscenarioswordt vertaald…
The core impact of CVE-2026-27931 lies in the potential for local information disclosure. An attacker who can trigger this vulnerability could read data beyond the intended boundaries of memory within the GDI component. While the vulnerability is described as local, this means an attacker needs some level of access to the system to exploit it. The specific data exposed is unknown, but it could include sensitive system information, user data, or potentially even parts of other applications' memory. The severity is classified as medium, suggesting a moderate risk of exploitation given the need for local access and the potential impact of data exposure.
Uitbuitingscontextwordt vertaald…
CVE-2026-27931 was published on April 14, 2026. As of the current date, there is no indication of active exploitation campaigns targeting this vulnerability. It is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog or has an EPSS score. Public proof-of-concept (POC) code is currently unavailable, which reduces the immediate risk of widespread exploitation.
Dreigingsinformatie
Exploit Status
EPSS
0.05% (14% percentiel)
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Lokaal — aanvaller heeft een lokale sessie of shell op het systeem nodig.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Geen — geen authenticatie vereist om te exploiteren.
- User Interaction
- Vereist — slachtoffer moet een bestand openen, op een link klikken of een pagina bezoeken.
- Scope
- Ongewijzigd — impact beperkt tot het kwetsbare component.
- Confidentiality
- Hoog — volledig verlies van vertrouwelijkheid. Aanvaller kan alle gegevens lezen.
- Integrity
- Geen — geen integriteitsimpact.
- Availability
- Geen — geen beschikbaarheidsimpact.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gepubliceerd
- Gewijzigd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2026-27931 is to upgrade affected Windows systems to version 10.0.28000.1836 or later, which includes the security patch. If immediate patching is not possible, consider implementing stricter access controls to limit the potential for local attackers to exploit the vulnerability. While there are no specific WAF or proxy rules that can directly address this vulnerability, ensuring that the GDI component is up-to-date is the most effective preventative measure. After upgrading, confirm the fix by verifying the Windows build version is 10.0.28000.1836 or higher using systeminfo command.
Hoe te verhelpenwordt vertaald…
Aplica las actualizaciones de seguridad proporcionadas por Microsoft para Windows 10. Estas actualizaciones corrigen una vulnerabilidad de divulgación de información en el componente GDI, previniendo que atacantes puedan acceder a datos sensibles en tu sistema. Asegúrate de instalar las últimas actualizaciones a través de Windows Update.
Veelgestelde vragenwordt vertaald…
What is CVE-2026-27931 — Information Disclosure in Windows GDI?
CVE-2026-27931 is a medium severity vulnerability in Windows GDI that allows an attacker to disclose information locally due to an out-of-bounds read. It affects Windows 10 versions 10.0.19044.0 through 10.0.28000.1836.
Am I affected by CVE-2026-27931 in Windows GDI?
You are affected if your system is running Windows 10 versions 10.0.19044.0 through 10.0.28000.1836. Check your version using the ver command.
How do I fix CVE-2026-27931 in Windows GDI?
Upgrade your Windows system to version 10.0.28000.1836 or later to receive the security patch. This is the primary and recommended mitigation.
Is CVE-2026-27931 being actively exploited?
As of the current date, there is no public evidence of active exploitation campaigns targeting CVE-2026-27931.
Where can I find the official Windows advisory for CVE-2026-27931?
Refer to the Microsoft Security Update Guide for the official advisory and details related to CVE-2026-27931.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Probeer het nu — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...