CVE-2026-49796

Windows GDI+ is a built-in component Windows uses to handle graphics—like when you open images or other content. This bug is a memory-safety flaw that can be hit when a user interacts with specially crafted content, allowing code to run on the local machine. Think of it like a “dangerous file” that can trick the graphics viewer into executing attacker instructions when you view it.

This matters if your small business uses any of these operating systems: Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025. The bug does not require authentication, but it requires local access plus user interaction with malicious content, which is most realistic when employees open files or view images from email, messaging, or the web. Reachability is therefore mainly about whether an attacker can get a user to interact with crafted content on a vulnerable endpoint.

This is a RED issue because it can lead to local arbitrary code execution on real Windows endpoints when a user interacts with malicious content. Even though we don’t have clear evidence of exploitation being widely reported in the provided sources, the impact is high (code execution locally) and it affects multiple supported Windows 10/11 and Windows Server releases, so patching should be treated as urgent.