CVE-2026-54122 is a Windows GDI+ heap-based buffer overflow that can lead to remote code execution. Microsoft rates it CVSS v3.1 base 8.4 (High) with a temporal score of 7.3; the vector is LOCAL, LOW attack complexity, NONE privileges required, and NONE user interaction required, with HIGH impacts to confidentiality, integrity, and availability. Microsoft says no public disclosure and no known exploitation, with exploit code maturity UNPROVEN. Customer action is required. Because the attack vector is local rather than network-based, it is a lower enterprise exposure than remotely exploitable issues, but it still represents a high-severity code execution risk on affected Windows systems.

Highlights:
- CVSS scores: Base 8.4 - Temporal 7.3
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Remote Code Execution with HIGH confidentiality, HIGH integrity, and HIGH availability impacts.
- Exploitation likelihood: Exploitation Less Likely; vector is LOCAL with LOW attack complexity, NO privileges required, and NO user interaction required.
- Severity for enterprise: High severity, but enterprise risk is reduced compared with network-exposed RCE because exploitation requires local access rather than remote service reachability.
- Patch status: available

Affected systems:
- Windows 10 1607
- Windows 10 1809
- Windows 10 21H2
- Windows 10 22H2
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025