CVE-2026-20846CWE-126

CVE-2026-20846

High · published February 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

⚡ A sneaky buffer over-read in Windows GDI+ could let attackers pull the rug out from under your network traffic! Think of it like a waiter at a restaurant who keeps bringing back your order but leaves a large gap in your meal — if they don't check what's on the platter, your guests might just leave hungry! This vulnerability allows unauthorized attackers to exploit the buffer over-read, potentially leading to a denial of service. If successfully exploited, it could bring your services to a standstill, leaving users frustrated and unable to access critical applications. That's absolutely devastating for any organization relying on consistent uptime!

Put simply

Think of it like a waiter at a restaurant who keeps bringing back your order but leaves a large gap in your meal — if they don't check what's on the platter, your guests might just leave hungry! The issue involves a buffer over-read in Windows GDI+, which allows attackers to read beyond the intended memory space, creating conditions for denial of service. This means that an attacker can manipulate memory access to disrupt the normal functioning of the service.

What to do

This vulnerability allows unauthorized attackers to exploit the buffer over-read, potentially leading to a denial of service. If successfully exploited, it could bring your services to a standstill, leaving users frustrated and unable to access critical applications. That's absolutely devastating for any organization relying on consistent uptime! To mitigate this risk, update your Windows GDI+ to the latest version immediately. Ensure that your network configurations are secure and consider implementing additional monitoring to detect signs of suspicious activity. You've got this! Follow these steps and you'll keep your network secure and running smoothly. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01430 · 72.8th percentile
Weakness
CWE-126 · Buffer Over-read
Published
2026-02-10T23:16Z
Affected products (23)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.886810.0.14393.8868
microsoft/windows_10_1607< 10.0.14393.886810.0.14393.8868
microsoft/windows_10_1809< 10.0.17763.838910.0.17763.8389
microsoft/windows_10_1809< 10.0.17763.838910.0.17763.8389
microsoft/windows_10_21h2< 10.0.19044.693710.0.19044.6937
microsoft/windows_10_21h2< 10.0.19044.693710.0.19044.6937
microsoft/windows_10_21h2< 10.0.19044.693710.0.19044.6937
microsoft/windows_10_22h2< 10.0.19045.693710.0.19045.6937
microsoft/windows_10_22h2< 10.0.19045.693710.0.19045.6937
microsoft/windows_10_22h2< 10.0.19045.693710.0.19045.6937
microsoft/windows_11_23h2< 10.0.22631.664910.0.22631.6649
microsoft/windows_11_23h2< 10.0.22631.664910.0.22631.6649
microsoft/windows_11_24h2< 10.0.26100.778110.0.26100.7781
microsoft/windows_11_24h2< 10.0.26100.778110.0.26100.7781
microsoft/windows_11_25h2< 10.0.26200.778110.0.26200.7781
microsoft/windows_11_25h2< 10.0.26200.778110.0.26200.7781
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.886810.0.14393.8868
microsoft/windows_server_2019< 10.0.17763.838910.0.17763.8389
microsoft/windows_server_2022< 10.0.20348.471110.0.20348.4711
microsoft/windows_server_2022_23h2< 10.0.25398.214910.0.25398.2149
microsoft/windows_server_2025< 10.0.26100.3231310.0.26100.32313
References (1)
EPSS history
Timeline
  • 10 FEB 17:51Z
    GDI+ Denial of Service Vulnerability
    cvelistv5