CVE-2026-68827: CWE-191: Integer Underflow (Wrap or Wraparound) in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-68827) involves an integer underflow (wrap or wraparound) in the Windows GDI+ library. It affects several specific builds of Windows 10 starting from version 1607 and later, as detailed by the affected version ranges. The flaw enables an authorized attacker to perform privilege escalation remotely over a network. The CVSS 3.1 vector indicates the attack requires low complexity, privileges, and user interaction, and impacts confidentiality, integrity, and availability with high severity. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this integer underflow vulnerability in Windows GDI+ to elevate privileges remotely over a network. This could allow the attacker to gain higher-level access than intended, potentially compromising system confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68827. No additional mitigation steps are indicated beyond applying the official patch.