CVE-2026-62709: Windows 10 1607 Information Disclosure Flaw

CVE-2026-62709 Overview

CVE-2026-62709 is an information disclosure vulnerability in the Windows Graphics Device Interface Plus (GDI+) component. The flaw results from the use of an uninitialized resource [CWE-908], which allows an authorized local attacker to read memory contents that should not be exposed to their privilege level. Microsoft rates the issue at CVSS 5.5 with a local attack vector and low privileges required.

The vulnerability affects a wide range of client and server Windows editions, including Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Successful exploitation does not affect integrity or availability, but leaked memory contents can include sensitive process data, cryptographic material, or address layout information useful for chaining further attacks.

Critical Impact
An authenticated local attacker can read uninitialized memory through Windows GDI+, potentially disclosing sensitive information from other processes or the kernel.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62709 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-62709

Vulnerability Analysis

GDI+ (gdiplus.dll) is the Windows subsystem responsible for two-dimensional graphics, image rendering, and font handling. It is loaded by countless user-mode applications and services, and its parsers process untrusted image and metafile data. Any authenticated user who can invoke GDI+ APIs, directly or indirectly through a document or image processing workflow, reaches the vulnerable code path.

The issue is classified under [CWE-908] Use of Uninitialized Resource. GDI+ allocates a buffer or object and reads from it before all fields are populated with defined values. The residual data returned to the caller reflects whatever previously occupied that memory region, which may include pointers, handles, or fragments of prior graphics operations.

Because the confidentiality impact is High while integrity and availability are unaffected, the vulnerability is an information disclosure primitive rather than a code execution vector. Attackers commonly pair such primitives with memory-safety bugs to defeat Address Space Layout Randomization (ASLR).

Root Cause

The root cause is a code path in Windows GDI+ that returns or operates on a memory region without first initializing every field consumed by the caller. The uninitialized bytes are then reachable through a legitimate API return value, exception path, or serialized output. No memory corruption occurs; the vulnerability is purely a read of stale data.

Attack Vector

Exploitation requires local access and a valid user session (AV:L, PR:L). The attacker crafts input, typically a malformed image, metafile, or font resource, and passes it to a component that calls into GDI+. The API returns data that includes uninitialized bytes, which the attacker exfiltrates or inspects. No user interaction is required beyond the attacker's own actions. Public exploit code is not available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.396%.

See the Microsoft Security Update for CVE-2026-62709 for authoritative technical details.

Detection Methods for CVE-2026-62709

Indicators of Compromise

Unexpected loading of gdiplus.dll by processes that do not normally render graphics, such as command-line utilities or service accounts.
Repeated crashes or exceptions in gdiplus.dll recorded in the Windows Application event log, which can indicate probing for the flaw.
Local processes writing large numbers of small image or metafile artifacts to disk followed by outbound data transfer from that user account.

Detection Strategies

Hunt for non-standard executables and scripts that invoke GDI+ imaging APIs, correlating parent-child process relationships against known-good baselines.
Alert on unsigned or newly observed binaries loading gdiplus.dll shortly after being written to disk by a standard user.
Review endpoint telemetry for image or font files with abnormal structure delivered through email, chat, or removable media, followed by rendering by a low-privileged account.

Monitoring Recommendations

Ensure endpoint detection and response (EDR) telemetry captures module loads, image file opens, and crash events on all Windows 10, 11, and Server systems in scope.
Forward Windows Error Reporting (WER) and Application event logs to a central SIEM to identify clusters of GDI+ faults across the fleet.
Track patch deployment status for the August 2026 Microsoft security update and alert on hosts that remain unpatched beyond the maintenance window.

How to Mitigate CVE-2026-62709

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-62709 across all affected Windows client and server editions.
Prioritize multi-user systems, jump hosts, and Remote Desktop Services servers, where a low-privileged local user is most likely to abuse the flaw.
Audit local account membership and remove unnecessary interactive logon rights to reduce the population of users who can reach the vulnerable code path.

Patch Information

Microsoft has issued cumulative updates addressing CVE-2026-62709 for Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Refer to the Microsoft Security Update Guide for the specific knowledge base article and build numbers per platform.

Workarounds

No official workaround is published by Microsoft; installing the security update is the supported remediation.
Restrict the ability of untrusted users to submit arbitrary images, metafiles, and fonts to server-side rendering workflows until the patch is deployed.
Enforce the principle of least privilege and disable interactive logon for service accounts to limit local exposure on unpatched hosts.

bash

# Verify patch status on Windows using PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# Check installed OS build to confirm it matches the patched build listed in MSRC
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR