CVE-2026-49796 is a heap-based buffer overflow vulnerability in the Windows GDI+ component affecting Windows 10 Version 1607 (build 10.0.14393.0). The vulnerability allows local attackers to execute arbitrary code with elevated privileges. The CVSS v3.1 base score is 7.8, indicating a high severity with attack vector local, low attack complexity, no privileges required, but user interaction needed. Microsoft has released an official fix to address this vulnerability.

Successful exploitation could allow an attacker to execute arbitrary code locally, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49796 to remediate this vulnerability.