CVE-2026-62890

Think of Windows GDI+ like the part of Windows that helps handle graphics. This bug lets a person who already has low-level access to a computer feed it bad input so that Windows mishandles memory—leading to a crash or, in the worst case, full control of the machine. For a business, that can turn a “limited access” problem into complete system takeover.

This matters if you run Windows 10, Windows 11, or Windows Server 2012/2016/2019/2022/2025/2012 R2. Because the issue requires local access with low privileges and needs no user interaction, your risk is highest if an attacker (or a compromised account) can already get onto a machine as a non-admin user. Patch is specifically important for systems that could be reached by an attacker who can log in locally or obtain low-privilege access.

This is urgent because attackers only need low-privilege local access to potentially get full control, and the underlying flaw can be triggered without user interaction. Even though there’s no confirmed publicly reported exploitation tied to this exact CVE, it is a high-severity Windows elevation-of-privilege issue and a patch is available.