This vulnerability (CVE-2026-27930) involves an out-of-bounds read in the Windows GDI component on Windows 10 Version 1607 (build 10.0.14393.0). An attacker with local access and the ability to trigger the vulnerability can cause the system to disclose information by reading memory beyond allocated buffers. The vulnerability does not allow for privilege escalation, denial of service, or code execution, but it can lead to unauthorized information disclosure. Microsoft has released an official patch to remediate this issue.

Successful exploitation of this vulnerability allows an attacker with local access to read sensitive information from memory that should be inaccessible, potentially leading to information disclosure. The vulnerability does not impact system integrity or availability and does not allow remote exploitation. There are no known exploits in the wild currently.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27930 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.