CVE-2026-54122

Think of Windows GDI+ as a part of Windows that helps handle certain graphics. This bug is like a safety rule that can be bypassed, letting a bad actor force Windows to jump to harmful code. If it’s reachable on a machine, the attacker may be able to take control of that machine and install further malware.

This matters if you run Windows 10, Windows 11, or any of the listed Windows Server versions using the Windows GDI+ component. The flaw does not require a login and does not require the user to click anything, but the findings do not confirm whether it’s reachable in the default configuration. Treat it as a risk when an attacker can run a local attack path on the machine (for example, through an exposed process or a way to get code execution locally), then prioritize patching.

This is a RED issue because it allows arbitrary code execution on the affected Windows systems, and it requires no authentication or user interaction. Even though the findings don’t document a public exploit or CISA KEV listing, the ability to run code makes timely patching essential.