CVE-2026-50387

This is a security bug that can be triggered when Windows is handling graphics-related work (Windows GDI). If an attacker already has local access to your computer, the bug could let them gain higher privileges—meaning they could take more control of the device than normal user access would allow. Think of it like a weakness in a “door lock” inside the building that an insider (someone already on site) can exploit to get into restricted areas.

This matters to you if your business uses vulnerable Windows systems (Windows 10/11 and Windows Server 2012/2012 R2/2016/2019) and if you run the listed Microsoft Office clients on those platforms. The key risk is tied to a local attacker: you should focus on devices where someone with authorized local access could be present (for example, a compromised or untrusted user account on an affected machine). This is primarily a risk when an attacker can already get local access on the device; default “internet-only” reachability is not established in the provided findings.

This is RED because the vulnerability allows local privilege escalation—attackers who can get local access can potentially gain elevated rights and take control of the system. Microsoft has new guidance/patch activity, but CISA KEV is not listed in the provided findings, and there’s no confirmed dated public exploit report—so your best move is to patch now rather than wait for more evidence.