This vulnerability involves an out-of-bounds read in the Windows Graphics Device Interface (GDI) on Windows 10 Version 21H2 (build 10.0.19044.0). An attacker with local access and the ability to trigger the flaw can cause the system to read memory outside the intended bounds, potentially disclosing sensitive information. The issue does not allow for privilege escalation, denial of service, or integrity compromise, only confidentiality impact. Microsoft has released an official fix to address this vulnerability.

An unauthorized local attacker can exploit this vulnerability to read memory beyond the intended buffer limits in Windows GDI, leading to potential disclosure of sensitive information. There is no impact on system integrity or availability. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27931 to remediate this vulnerability.