This vulnerability involves an out-of-bounds read (CWE-125) in the Windows GDI subsystem in Windows 10 Version 21H2 (build 10.0.19044.0). An attacker with local access and the ability to trigger a user interaction can exploit this flaw to read sensitive information from memory, potentially leading to information disclosure. The vulnerability does not allow privilege escalation, integrity, or availability impact. Microsoft has released an official patch to remediate this issue.

Successful exploitation allows an unauthorized local attacker to disclose sensitive information from memory due to an out-of-bounds read in the Windows GDI component. The confidentiality impact is high, but there is no impact on integrity or availability. The attack requires local access and user interaction, limiting the attack vector to local users who can run code or interact with the system.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27931 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.