This vulnerability, identified as CVE-2026-49796, is a heap-based buffer overflow in the Windows GDI+ library affecting Windows 10 Version 1607 (build 10.0.14393.0). The flaw enables an unauthorized attacker to execute arbitrary code locally, potentially leading to full system compromise. The CVSS v3.1 score is 7.8 (high), reflecting local attack vector, low attack complexity, no privileges required, but user interaction is necessary. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

Successful exploitation of this heap-based buffer overflow can result in arbitrary code execution with high impact on confidentiality, integrity, and availability of the affected system. The attacker must have local access and the user must interact to trigger the vulnerability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49796 to remediate this vulnerability.