CVE-2026-50380

What it actually does

This vulnerability is a heap-based buffer overflow in Windows GDI+, the Windows graphics rendering component used by many desktop and server applications to parse and display image content. A remote, unauthenticated attacker can craft malicious graphical content that, when opened or previewed by a user or processed by an application using GDI+, corrupts heap memory and can result in arbitrary code execution in the context of the affected process. Because the flaw is network-reachable but requires user interaction, common exposure scenarios include email attachments, embedded images in documents, downloaded files, web content, or files opened from network shares.

Why it matters to the business

Successful exploitation could allow an attacker to take control of a workstation or server process, steal data, deploy malware, establish persistence, or use the compromised system as a foothold for lateral movement. The vulnerability affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and multiple Windows Server versions, so organizations may have widespread exposure. Although it is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score at this time, the high CVSS severity means remediation should be treated as important because exploitation would have severe confidentiality, integrity, and availability consequences.

How an attack unfolds

An attacker prepares a specially malformed image or file format that is handled by Windows GDI+. The attacker delivers it through a network-accessible channel such as email, a collaboration platform, a website, a file share, or a document containing embedded graphical content. When a user opens or previews the content, or when an application automatically renders it, GDI+ processes the malformed data and triggers a heap-based buffer overflow. If the attacker has shaped memory reliably, the overflow redirects execution flow and runs attacker-controlled code inside the rendering application. From there, the attacker can launch a payload, connect to command-and-control infrastructure, dump credentials available to the user context, create persistence, or move laterally. If exploitation is unreliable, failed attempts may appear as application crashes involving gdiplus.dll and access violation errors.

How to fix it

Apply the vendor security update for all affected Windows versions as soon as it is available through Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog. Prioritize Windows endpoints and servers that process untrusted files, receive email attachments, host file shares, support remote users, or run applications that render images or documents. Because no exact fixed build or package version was provided, validate remediation against Microsoft’s official security update guidance for CVE-2026-50380 and the affected operating system release. Where immediate patching is not possible, reduce exposure by disabling automatic preview of untrusted attachments where feasible, limiting the ability to open internet-sourced files on sensitive servers, enforcing least privilege, using application control, blocking high-risk attachment types at email and web gateways, and ensuring EDR is active on affected systems.

How to confirm the fix worked

Confirm that all affected Windows 10, Windows 11, and Windows Server systems have installed the Microsoft security update that addresses this vulnerability. Use endpoint management and vulnerability scanning tools to verify operating system build numbers, installed cumulative updates, and gdiplus.dll file versions against Microsoft’s official fixed-state guidance. Test representative systems by confirming they no longer appear as vulnerable in authenticated scans. Review patch deployment reports from WSUS, Microsoft Configuration Manager, Intune, or equivalent tooling for failed installations, pending reboots, supersedence issues, and unsupported operating system versions. For systems that cannot be patched immediately, validate that compensating controls such as attachment filtering, disabled preview behavior, least-privilege enforcement, and EDR monitoring are in place.

Typical attack path

1. Identify targets running affected Windows client or server versions that are likely to open or process externally supplied image or document content.
2. Craft a malicious file containing malformed graphical data designed to trigger the GDI+ heap overflow.
3. Deliver the file through email, web content, messaging, file-sharing, or another network-accessible channel.
4. Wait for a user or application to open, preview, index, scan, or render the malicious content.
5. Trigger heap corruption in GDI+ and attempt to gain code execution in the context of the rendering process.
6. Execute a follow-on payload such as a downloader, remote access tool, credential theft utility, or persistence mechanism.
7. Use the compromised endpoint or server as a foothold for data access, privilege escalation, or lateral movement.

How to detect it

Detection should focus on evidence of attempted exploitation through malformed graphical content and post-exploitation behavior. Review Windows Application logs, Windows Error Reporting artifacts, EDR telemetry, Sysmon logs, email gateway logs, proxy logs, and file download records for suspicious files opened shortly before crashes in applications that render images or documents. Look for application crashes where the faulting module is gdiplus.dll and the exception is an access violation, especially in Outlook, Word, Excel, PowerPoint, Explorer, image viewers, browsers, PDF readers, or messaging applications. Correlate crashes with newly created files in user download, email attachment, browser cache, temporary, or content-sync directories. Hunt for suspicious child processes spawned by rendering applications, such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, or curl.exe. Also review outbound network connections initiated shortly after file open or process crash events. Because no public exploit or malware-specific indicators are known from the provided information, detection should rely on behavioral correlation rather than fixed malware hashes or domains.

• Faulting module name: gdiplus.dll
• Exception code: 0xc0000005
• Exception code: c0000005
• Windows Error Reporting
• Application Error
• Faulting application name: OUTLOOK.EXE
• Faulting application name: WINWORD.EXE
• Faulting application name: EXCEL.EXE
• Faulting application name: POWERPNT.EXE
• Faulting application name: explorer.exe
• Faulting application name: Microsoft.Photos.exe
• Faulting application name: AcroRd32.exe
• Faulting application name: msedge.exe
• Faulting application name: chrome.exe
• Faulting application name: firefox.exe
• OUTLOOK.EXE -> powershell.exe
• WINWORD.EXE -> powershell.exe
• EXCEL.EXE -> powershell.exe
• POWERPNT.EXE -> powershell.exe
• explorer.exe -> powershell.exe
• OUTLOOK.EXE -> cmd.exe
• WINWORD.EXE -> cmd.exe
• EXCEL.EXE -> cmd.exe
• POWERPNT.EXE -> cmd.exe
• OUTLOOK.EXE -> wscript.exe
• WINWORD.EXE -> wscript.exe
• OUTLOOK.EXE -> mshta.exe
• WINWORD.EXE -> mshta.exe
• OUTLOOK.EXE -> rundll32.exe
• WINWORD.EXE -> rundll32.exe
• OUTLOOK.EXE -> regsvr32.exe
• WINWORD.EXE -> regsvr32.exe
• gdiplus.dll

What your security team should do

• Prioritize patching because the vulnerability has critical impact even though public exploitation and KEV listing are not currently reported.
• Inventory affected Windows 10, Windows 11, and Windows Server assets and group them by exposure to untrusted documents, images, email, web browsing, and file-sharing workflows.
• Deploy the applicable Microsoft security update through standard patch management channels and monitor for failed installations or systems pending reboot.
• Temporarily reduce risk by disabling automatic preview of untrusted files where operationally feasible and by filtering suspicious image, document, and archive attachments at email and web gateways.
• Increase monitoring for application crashes involving gdiplus.dll, especially access violations followed by suspicious child processes or network connections.
• Hunt for suspicious process ancestry where document, email, browser, image viewer, or shell processes spawn command shells, scripting engines, download tools, or unsigned executables.
• Ensure endpoint protection, exploit protection, attack surface reduction rules, and application control policies are enabled on high-risk workstations and servers.
• Prepare accelerated remediation for any future change in exploit maturity, EPSS trajectory, ransomware use, or CISA KEV status.