CVE-2026-35421: Windows 10 1607 Buffer Overflow Flaw

CVE-2026-35421 Overview

CVE-2026-35421 is a heap-based buffer overflow vulnerability in the Windows Graphics Device Interface (GDI) component. The flaw allows an unauthorized local attacker to execute arbitrary code on affected systems after convincing a user to interact with a malicious file or resource. The weakness is classified under CWE-122: Heap-based Buffer Overflow.

Microsoft published the advisory through the Microsoft Security Update Guide. The vulnerability affects a broad range of Windows desktop and server releases, including Windows 10, Windows 11, and Windows Server 2012 through 2025.

Critical Impact

Successful exploitation grants attackers code execution at the privilege level of the targeted user, with full impact to confidentiality, integrity, and availability on the affected host.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-05-12 - CVE-2026-35421 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-35421

Vulnerability Analysis

The vulnerability resides in the Windows GDI subsystem, which renders graphical primitives, fonts, and image formats for user-mode applications and kernel components. A heap-based buffer overflow occurs when GDI processes a malformed graphics object and writes beyond the allocated heap buffer. The overflow corrupts adjacent heap metadata or object pointers, enabling control over execution flow.

Exploitation requires user interaction. An attacker delivers a crafted file or resource, such as a malicious image, font, or document with embedded graphics, that the victim opens. The local attack vector with required user interaction is reflected in the CVSS vector. The vulnerability impacts every supported Windows client and server line, which broadens the exposed attack surface across enterprise estates.

The EPSS probability is currently low, but heap corruption flaws in GDI have historically been weaponized in document and font-parsing exploit chains.

Root Cause

The root cause is improper validation of input length or structure when GDI allocates and populates a heap buffer for a graphics object. The component fails to enforce boundary checks before copying attacker-controlled data into the buffer, resulting in an out-of-bounds heap write consistent with [CWE-122].

Attack Vector

The attack chain begins with social engineering. An attacker hosts or emails a malicious file that triggers GDI parsing when opened or previewed. The crafted object overflows the heap allocation inside gdi32.dll or related GDI components, overwrites control data, and pivots execution into attacker-supplied shellcode. Because the local attacker is unauthenticated to the system at the time the file is delivered, exploitation can chain with phishing campaigns or drive-by downloads to gain an initial foothold.

No public proof-of-concept code or in-the-wild exploitation has been confirmed at the time of writing. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-35421

Indicators of Compromise

• Unexpected crashes or access violations in processes loading gdi32.dll, gdi32full.dll, or win32k.sys shortly after a user opens a document, image, or font file.
• New or unsigned child processes spawned by Office applications, image viewers, or browsers immediately following a graphics rendering operation.
• Suspicious files with image, font (.ttf, .otf, .fon), or metafile (.emf, .wmf) extensions delivered via email or downloaded from untrusted sources.

Detection Strategies

• Hunt for process crashes with exception code 0xC0000374 (heap corruption) or 0xC0000005 (access violation) in user-mode applications consuming graphics content.
• Correlate file open events for image, font, and document files with subsequent anomalous process creation, memory allocation, or network activity.
• Apply behavioral detection rules that flag exploitation primitives such as shellcode execution from non-executable regions or unexpected ROP gadget patterns.

Monitoring Recommendations

• Ingest Windows Error Reporting (WER) telemetry and EDR process telemetry into a central SIEM to surface GDI-related crashes across the fleet.
• Monitor email gateways and web proxies for inbound files with embedded graphics or fonts from external senders.
• Track patch deployment status for the May 2026 Windows security updates and alert on hosts that remain unpatched after the maintenance window.

How to Mitigate CVE-2026-35421

Immediate Actions Required

• Apply the May 2026 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows clients and servers.
• Prioritize patching for workstations that handle external documents, images, and fonts, then expand to file servers and remote desktop hosts.
• Validate patch deployment by verifying the updated build numbers of gdi32.dll, gdi32full.dll, and related GDI binaries.

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-35421 for all supported Windows 10, Windows 11, and Windows Server editions listed in the advisory. Refer to the Microsoft Security Update Guide for KB article numbers, build identifiers, and platform-specific download links.

Workarounds

• Restrict the opening of untrusted image, font, and metafile content by enforcing Attack Surface Reduction (ASR) rules and blocking risky file types at the email gateway.
• Enforce Protected View and Application Guard for Office to isolate document rendering away from the user session.
• Disable preview handlers for image and font files in File Explorer and Outlook on systems that cannot be patched immediately.

# Verify the May 2026 cumulative update is installed (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Enable the ASR rule blocking executable content from email and webmail
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 \
                 -AttackSurfaceReductionRules_Actions Enabled