CVE-2026-85797 is a medium severity out-of-bounds read in Windows GDI, the graphics component. It lets an unauthorized attacker disclose information over a network, and the record notes user interaction is needed. Microsoft's update guide lists the fix for each affected build, so install the update for yours.
What's affected
- Product: Windows GDI, on Windows 10 versions 1607, 1809, 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2 and 26H1, per the record.
- Fixed versions: listed on the Microsoft Security Response Center page. It needs JavaScript, so I could not read it for this review. Open the entry for CVE-2026-85797 and match the update to your build.
- Attack path: network, no privileges, with user interaction.
Severity in the record: Medium, CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
Weakness class: CWE-125 (Out-of-bounds Read) CWE-20 (Improper Input Validation).
How to check if you're exposed
- Find your Windows version and build with
winver, or in PowerShell with[System.Environment]::OSVersion.Version. - Compare it with the product list above.
- List installed updates with
Get-HotFixand compare against the update named on the MSRC page for your build. - In a managed fleet, use your update management console to find devices that have not installed the update.
What to do now
- Open the Microsoft Security Update Guide entry for CVE-2026-85797 and note the update for each Windows build in your fleet.
- Deploy it through your usual patch channel, starting with machines that open files and links from outside the company.
- Verify with
Get-HotFixafter the restart. - Remind users to be careful with unexpected files, since the record says user interaction is required.
- Review any Windows 10 builds that are near or past the end of support.
Why it matters
An out-of-bounds read means code reads memory past the end of a buffer. The result here is information disclosure, which is why the rating is Medium with high confidentiality impact but no integrity or availability impact. The record also lists CWE-20, improper input validation, next to CWE-125, the out-of-bounds read.
Leaked memory can contain data that helps with a later step, such as memory layout details, which is why information leaks often appear in attack chains. The record gives no more detail. It is not marked as exploited in the wild and is not on the CISA list. Patch on your normal schedule, sooner for exposed machines.
Quick check
Does this need an attacker to be logged in?
No. The record says no privileges are required, but a user must take an action, such as opening something.
Sources
Last reviewed: 18 October 2026.
