NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
MEDIUM severity

CVE-2026-83651 — Microsoft

MEDIUM

CVE-2026-83651 is a medium-severity (CVSS 6.5) Out-of-bounds Read vulnerability. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

Published
Updated
Affected
14 products
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-83651.

EPSS Exploitation Probability

via FIRST.org ↗
1.0%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs64th percentile — riskier than 64% of all scored CVEsHighest risk
0.54%0.88%1.21%1.54%1.0%1.0%Nov 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Description

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.

Affected Products

14 products · 26 configurations
OS
windows 10 21h2microsoft
< 10.0.19044.7807
range
OS
windows 10 22h2microsoft
< 10.0.19045.7807
range
OS
windows 10 1607microsoft
< 10.0.14393.9612
range
OS
windows 10 1809microsoft
< 10.0.17763.9376
range
OS
windows 11 23h2microsoft
< 10.0.22631.7652
range
OS
windows 11 24h2microsoft
< 10.0.26100.9711
range

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    The records we use list no fixed release for CVE-2026-83651. Check the upstream advisory for a patched version, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    Constrain what reaches the vulnerable code: limit the size and shape of untrusted input, isolate the affected component in a sandboxed or least-privileged process, and enable the platform's memory-safety mitigations (ASLR, stack protector, hardened allocator) so an out-of-bounds access is more likely to fail closed than to be exploitable.

Frequently Asked Questions

Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a network.
O3 Security · Impact-Aware SCA

Is CVE-2026-83651 in your dependencies?

Find it across your dependency tree, including transitive dependencies.

Scan my dependencies How O3 SCA works