CVE-2026-50380
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Risk Assessment
An attacker can remotely execute arbitrary code on a Windows system, potentially leading to full system compromise and data theft.
Recommendation
Install the latest Windows security update from Microsoft.
Other vulnerabilities in Windows GDI+
See all- CVE-2026-35421High
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.
- CVE-2025-53766Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2020-1179Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2020-0963Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2019-0903HighActively exploited
A remote code execution vulnerability in the Windows GDI+ interface, caused by improper handling of objects in memory. An attacker could exploit this to execute arbitrary code remotely.
- CVE-2026-85797Medium
An out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
- CVE-2026-83934High
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2026-83929High
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
- CVE-2026-83860High
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
- CVE-2026-83651Medium
Out-of-bounds read vulnerability in Windows GDI allows an unauthorized attacker to disclose information over a network.
Original NVD description (English source)
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS