CVE-2026-70089
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Heap-based buffer overflow in Windows GDI. An unauthorized attacker can execute code over a network.
Risk Assessment
High risk — unauthenticated remote code execution can lead to full system compromise and further lateral movement.
Recommendation
Immediately install Microsoft patches for Windows GDI and limit exposure of GDI-based services to external networks.
Other vulnerabilities in Windows GDI
See all- CVE-2026-35421High
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.
- CVE-2026-50380Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2025-53766Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2020-1179Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2020-0963Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2019-0903HighActively exploited
A remote code execution vulnerability in the Windows GDI+ interface, caused by improper handling of objects in memory. An attacker could exploit this to execute arbitrary code remotely.
- CVE-2026-85797Medium
An out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
- CVE-2026-83934High
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2026-83929High
Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network.
- CVE-2026-83860High
Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
Original NVD description (English source)
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS