CVE-2026-69288: Windows GDI+ Information Disclosure Vulnerability

Microsoft describes the vulnerability as: “Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information locally.”

The exposed data, according to Microsoft’s advisory, is uninitialized heap memory. That matters because memory that has not been initialized can contain residual information from earlier operations. The advisory does not describe a remote attack path or an integrity or availability impact.

Severity, scoring, and exploitation assessment​

Publicly disclosed: No
Exploited: No
Customer action required: Yes

The CVSS vector indicates a local attack scenario with low attack complexity and low privileges required. Microsoft’s assessment is Exploitation Unlikely, but that should not be mistaken for a reason to defer ordinary patch management. Local information disclosure bugs can matter in shared workstations, virtual desktop deployments, terminal-server environments, and systems where an attacker has already obtained a foothold.

What Microsoft says can be disclosed​

Microsoft’s advisory specifically answers the obvious question:

“What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is uninitialized heap memory.”

Click to expand...

That wording is important. The advisory identifies a confidentiality issue involving memory contents; it does not describe a way to alter data, crash Windows, or run code. Even so, uninitialized memory is the sort of digital attic where sensitive remnants may linger. The right response is still the wonderfully unglamorous one: deploy the applicable cumulative update and verify the resulting build number.

Affected Windows releases and fixed builds​

The following product-to-KB mappings are supplied in Microsoft’s advisory data.

Required remediation by product​

• For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5123099 to reach fixed build 10.0.14393.9512.
• For Windows 10 Version 1607 for x64-based Systems, install KB5123099 to reach fixed build 10.0.14393.9512.
• For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5122876 to reach fixed build 10.0.17763.9245.
• For Windows 10 Version 1809 for x64-based Systems, install KB5122876 to reach fixed build 10.0.17763.9245.
• For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19044.7725.
• For Windows 10 Version 21H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
• For Windows 10 Version 21H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
• For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19045.7725.
• For Windows 10 Version 22H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
• For Windows 10 Version 22H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
• For Windows 11 Version 23H2 for ARM64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
• For Windows 11 Version 23H2 for x64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
• For Windows 11 Version 24H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
• For Windows 11 Version 24H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
• For Windows 11 Version 25H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
• For Windows 11 Version 25H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
• For Windows 11 Version 26H1 for ARM64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
• For Windows 11 version 26H1 for x64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
• For Windows Server 2012 (Server Core installation) (x64), install KB5123065 to reach fixed build 6.2.9200.26349.
• For Windows Server 2012 (x64), install KB5123065 to reach fixed build 6.2.9200.26349.
• For Windows Server 2012 R2 (Server Core installation) (x64), install KB5123066 to reach fixed build 6.3.9600.23398.
• For Windows Server 2012 R2 (x64), install KB5123066 to reach fixed build 6.3.9600.23398.
• For Windows Server 2016 (Server Core installation) (x64), install KB5123099 to reach fixed build 10.0.14393.9512.
• For Windows Server 2016 (x64), install KB5123099 to reach fixed build 10.0.14393.9512.
• For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
• For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
• For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
• For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
• For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438.
• For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.

Practical deployment guidance​

For managed environments, use the KB-to-build mapping rather than relying only on an update’s title. Cumulative updates can address numerous issues at once; the fixed build provides the concrete post-deployment check for this particular advisory.

Administrators should:

1. Identify affected Windows client and server versions, including Server Core installations.
2. Deploy the matching cumulative update through their established Windows update-management process.
3. Restart systems when the update process requires it.
4. Validate that endpoint build numbers meet the applicable fixed build listed above.
5. Record CVE-2026-69288 as remediated only after the relevant KB and build verification are complete.

The key operational point is straightforward: Microsoft requires customer action for CVE-2026-69288. Organizations should apply the update corresponding to each installed Windows release and architecture, then confirm the destination build—not merely assume the patch train arrived at the station.