Product:
Windows GDI
Summary
Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally. This vulnerability can lead to significant impacts on confidentiality, integrity, and availability. Attackers can exploit this flaw to run arbitrary code with the same privileges as the user.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-25190 |
Exploitation
To exploit this vulnerability, an attacker must convince a user to open a malicious file or application that triggers the untrusted search path. Once the user interacts with the malicious content, the attacker can execute arbitrary code on the system, potentially leading to unauthorized access and control over the affected machine.
Affected Products
- Windows GDI: Vulnerable due to untrusted search path allowing local code execution.
Mitigation
To mitigate this vulnerability, users should ensure that they only open files and applications from trusted sources. Regularly updating the system and applying security patches provided by Microsoft can also help protect against this and other vulnerabilities.