CVE-2026-62822

Think of Windows GDI+ as a part of Windows that helps handle certain graphics and related data. This flaw lets an attacker send a crafted set of data over the network that can make Windows do the wrong thing, which can lead to malicious code running on your computer—especially if the user is tricked into processing the content. If a business PC or server gets taken over, it can quickly lead to ransomware or data theft.

This matters if you run any of the affected Windows editions: Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025. The attack does not require attackers to authenticate, but it does require user interaction to be exploited. In practice, treat it as a risk when the vulnerable system is reachable from the network and attackers can get a user to interact with or process malicious content sent over the network.

This is RED because it enables remote code execution: attackers can send malicious network content that triggers code execution on your Windows machine. Even though user interaction is required and KEV does not list it, patching is still urgent because the impact (full compromise) is high and Microsoft has released fixed builds.