Windows GDI CVE-2026-35421: Brief Summary of a Heap Buffer Overflow Leading to Local Code Execution

Introduction

A heap-based buffer overflow in the Windows GDI subsystem, patched in Microsoft's May 2026 Patch Tuesday cycle, lets an attacker achieve local code execution by convincing a user to open a crafted Enhanced Metafile (EMF). The affected list runs from Windows Server 2012 through Windows 11 26H1 and covers 31 distinct product and platform combinations, so the attack surface is broad and touches virtually every supported Windows deployment in production today.

Technical Information

CVE-2026-35421 is a heap-based buffer overflow (CWE-122) in the Windows Graphics Device Interface (GDI), the core subsystem that renders graphical objects and sends them to output devices. The flaw is in how GDI parses EMF records. During metafile rendering, GDI allocates a heap buffer but does not properly validate the size of incoming record data against the buffer's boundaries. A crafted EMF file can therefore write past the end of the buffer and corrupt adjacent heap memory.

CVSS Breakdown

The CVSS 3.1 vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which gives a base score of 7.8.

GDI runs in the context of the calling process, so successful exploitation gives the attacker code execution with the privileges of the user who opened the malicious file.

Attack Flow

Based on the available source materials, the exploitation sequence is:

1. The attacker crafts a malicious EMF file whose records are built to trigger the heap buffer overflow during parsing.
2. The attacker delivers the file to the victim through a plausible channel, such as an email attachment, a file share, or a web download.
3. The victim opens or previews the EMF file in any application that relies on the Windows GDI subsystem for rendering, such as Microsoft Paint.
4. While parsing the EMF records, GDI allocates a heap buffer but does not properly validate the size of incoming data against the buffer boundaries.
5. The overflow corrupts adjacent heap memory. The attacker can use this corruption to take control of execution flow and run arbitrary code locally with the victim's privileges.

The "User Interaction: Required" metric is the main friction point. The vulnerability cannot be triggered unless a user actively opens or processes the crafted file. EMF files are common and generally trusted in enterprise environments, though, which lowers the social engineering barrier.

Patch Information

Microsoft shipped an official fix for CVE-2026-35421 on May 12, 2026, as part of its May 2026 Patch Tuesday release cycle. The MSRC Security Update Guide lists the remediation level as "Official Fix," which means a complete vendor solution is available and customer action is required.

The patch fixes GDI's EMF record parsing by adding proper bounds checking, which prevents the heap buffer from being overflowed during metafile rendering. GDI is a closed-source Windows component, so no public source code diff is available. The fix is delivered only through Microsoft's binary cumulative updates.

The patch spans 31 distinct product and platform combinations, covering client and server Windows editions as far back as Windows Server 2012. The table below lists the relevant Knowledge Base (KB) articles by product family.

For several modern platforms (Windows 11 24H2/25H2, Server 2025, and Server 2022), Microsoft provides both a standard cumulative security update and a Security Hotpatch update. The hotpatch applies the fix without a system reboot, which is especially useful for server workloads where downtime is costly. Both update paths fully remediate the vulnerability.

To verify that a system is patched, administrators should confirm that its OS build number meets or exceeds the value listed above. Updates are available through Windows Update, WSUS, and the Microsoft Update Catalog.

There are no documented workarounds or alternative mitigations, so organizations must rely entirely on the official patch to remediate this vulnerability.

Affected Systems and Versions

Based on the patch data, these Windows editions and versions are confirmed vulnerable until the listed patches are applied:

Windows Client:

• Windows 11 26H1 (x64 and ARM64), builds prior to 10.0.28000.2113
• Windows 11 25H2 / 24H2 (x64 and ARM64), builds prior to 10.0.26100.8457
• Windows 11 23H2 (x64 and ARM64), builds prior to 10.0.22631.7079
• Windows 10 22H2 (x64, ARM64, 32 bit), builds prior to 10.0.19045.7291
• Windows 10 21H2 (x64, ARM64, 32 bit), builds prior to 10.0.19044.7291
• Windows 10 1809, builds prior to 10.0.17763.8755
• Windows 10 1607, builds prior to 10.0.14393.9140

Windows Server:

• Windows Server 2025, builds prior to 10.0.26100.32860
• Windows Server 2022 23H2, builds prior to 10.0.25398.2330
• Windows Server 2022, builds prior to 10.0.20348.5139
• Windows Server 2019, builds prior to 10.0.17763.8755
• Windows Server 2016, builds prior to 10.0.14393.9140
• Windows Server 2012 R2, builds prior to 6.3.9600.23181
• Windows Server 2012, builds prior to 6.2.9200.26079

In total, 31 distinct product and platform combinations are affected.

References

• CVE-2026-35421 Detail, National Vulnerability Database
• CVE-2026-35421, Microsoft Security Update Guide
• Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days, BleepingComputer
• The May 2026 Security Update Review, Zero Day Initiative
• CVE-2026-35421, Tenable
• May 2026 Monthly Patch, Cyber Security Agency of Singapore
• Microsoft Security Update Guide
• Microsoft Update Catalog