Windows GDI+ vulnerabilities
20 known CVE vulnerabilities in Windows GDI+, translated and rated.
- CVE-2026-35421High
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally.
- CVE-2026-50380Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2025-53766Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2020-1179Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2020-0963Medium
An information disclosure vulnerability in Windows GDI component that improperly discloses memory contents. An attacker could obtain information to further compromise the user's system.
- CVE-2019-0903HighActively exploited
A remote code execution vulnerability in the Windows GDI+ interface, caused by improper handling of objects in memory. An attacker could exploit this to execute arbitrary code remotely.
- CVE-2026-77491Medium
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.
- CVE-2026-69288Medium
A vulnerability in Windows GDI+ involves the use of an uninitialized resource, allowing an authorized attacker to disclose information locally.
- CVE-2026-68827High
An integer underflow (wrap or wraparound) exists in Windows GDI+. This allows an authorized attacker to elevate privileges over a network.
- CVE-2026-65662Medium
An out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally.
- CVE-2026-62890High
Heap-based buffer overflow in Windows GDI+ allows an authorized attacker to execute code locally.
- CVE-2026-62822High
Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network.
- CVE-2026-62709Medium
Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.
- CVE-2026-61360Medium
Untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose information locally.
- CVE-2026-50387High
Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
- CVE-2026-54122High
A heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. The vulnerability occurs during the processing of specially crafted graphics data.
- CVE-2026-49796High
Windows GDI+ has a heap-based buffer overflow vulnerability, allowing an unauthorized attacker to execute code locally.
- CVE-2022-41098Medium
A vulnerability in Windows GDI+ allows information disclosure. An attacker could exploit this flaw to access sensitive data.
- CVE-2021-34498High
Vulnerability in Windows GDI allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.
- CVE-2021-34496Medium
Information disclosure vulnerability in Windows GDI. An attacker could read memory data, potentially exposing sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS