CVE-2026-62822: Windows 10 1607 GDI+ RCE Vulnerability

CVE-2026-62822 Overview

CVE-2026-62822 is an integer overflow vulnerability in the Windows Graphics Device Interface Plus (GDI+) component. The flaw allows an unauthenticated remote attacker to execute arbitrary code on affected systems when a user opens or renders a malicious graphics resource. Microsoft published the advisory on 2026-08-11, and the issue is tracked under CWE-122: Heap-based Buffer Overflow, which the integer wrap ultimately triggers. The vulnerability affects the full supported Windows client and server lineup, including Windows 10, Windows 11, and Windows Server 2012 through 2025.

Critical Impact
Successful exploitation grants remote code execution in the context of the process that renders the malicious image, enabling attacker-controlled code to run on unpatched Windows endpoints and servers across the enterprise.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-08-11 - CVE-2026-62822 published to the National Vulnerability Database
2026-08-11 - Microsoft released the security update through the Microsoft Security Update Guide
2026-08-13 - Last modified in the NVD database

Technical Details for CVE-2026-62822

Vulnerability Analysis

The flaw resides in Windows GDI+ (gdiplus.dll), the user-mode library that parses and renders 2D graphics, imaging, and typography formats such as JPEG, PNG, EMF, and TIFF. During image parsing, GDI+ performs arithmetic on attacker-controlled size fields to compute buffer allocations. When those computations wrap around the 32-bit integer boundary, the allocator returns a buffer smaller than the subsequent copy expects, leading to a heap-based out-of-bounds write [CWE-122].

Because GDI+ is invoked by many rendering surfaces, including Office, browsers, chat clients, thumbnail providers, and email preview panes, an attacker only needs a target to view or preview a crafted image. The UI:R component of the CVSS vector confirms that a single user interaction, such as opening a document or viewing a message, is sufficient. Successful exploitation runs code with the privileges of the calling process.

Root Cause

The root cause is unchecked integer arithmetic during graphics buffer sizing. Multiplying width, height, and bytes-per-pixel from parsed image headers produces a value that exceeds UINT_MAX and wraps to a small integer. GDI+ allocates that truncated size but then writes the full, larger payload, corrupting adjacent heap metadata and objects.

Attack Vector

An attacker delivers a specially crafted image or document over the network, typically through email, a web page, a shared file, or an instant message. When the victim opens or previews the content, GDI+ parses the malformed image and the overflow occurs. The attacker then leverages heap corruption to hijack control flow and execute code in the rendering process, which may be a browser, mail client, or shell handler running as the interactive user.

No verified public exploit code is available for CVE-2026-62822 at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.633%.

Detection Methods for CVE-2026-62822

Indicators of Compromise

Unexpected crashes, Windows Error Reporting entries, or Faulting module name: gdiplus.dll events on hosts that opened untrusted images or documents.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned from Office, Outlook, or browser processes shortly after image or attachment rendering.
Outbound network connections initiated by user-facing applications immediately after opening emailed or downloaded graphics files.

Detection Strategies

Hunt for process-injection or shellcode-execution behaviors originating from processes that load gdiplus.dll, correlating image file access with anomalous memory allocations.
Alert on Office, mail, and browser processes writing executables, scripts, or scheduled tasks to disk following image rendering.
Inspect email and web gateways for malformed JPEG, PNG, EMF, and TIFF files with header fields that would produce wrapped size calculations.

Monitoring Recommendations

Monitor Windows Event Log IDs 1000 and 1001 for application crashes referencing gdiplus.dll across the fleet.
Track patch compliance for the August 2026 Windows security updates on all endpoints and servers.
Baseline outbound connections from user productivity applications and alert on deviations that follow document or image previews.

How to Mitigate CVE-2026-62822

Immediate Actions Required

Apply the August 2026 Windows security updates from the Microsoft Security Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching on internet-facing servers, Remote Desktop hosts, and endpoints used for email and web browsing, where rendering of untrusted content is most likely.
Block or quarantine inbound email attachments containing uncommon image formats such as EMF and WMF at the mail gateway until patches are deployed.

Patch Information

Microsoft addressed CVE-2026-62822 in the August 2026 Patch Tuesday cumulative updates for each supported Windows release. Administrators should consult the Microsoft Security Update CVE-2026-62822 advisory for the specific KB article and build numbers that apply to each product and architecture, then validate deployment through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

Disable image preview in Outlook and Windows Explorer to reduce automatic invocation of GDI+ on untrusted content.
Enforce Attack Surface Reduction rules that block Office applications from creating child processes and from creating executable content.
Restrict rendering of legacy metafile formats (EMF, WMF) via Group Policy or file-type blocking at email and web proxies until patches are applied.

bash

# Verify installation of the August 2026 cumulative update on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm the patched gdiplus.dll version after update
Get-Item C:\Windows\System32\gdiplus.dll | Select-Object VersionInfo