High7.8Vendor: CriticalMicrosoft Server Updated
Windows GDI+ Remote Code Execution Vulnerability
CVE-2026-49796 Published Jul 14, 2026Updated by vendor Jul 14, 2026
Affected products & platforms
Microsoft ServerWindows Server
Summary
Windows GDI+ Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Affected versions
- Windows 10 Version 1607 10.0.14393.0
- Windows 10 Version 1809 10.0.17763.0
- Windows 10 Version 21H2 10.0.19044.0
- Windows 10 Version 22H2 10.0.19045.0
- Windows 11 Version 24H2 10.0.26100.0
- Windows 11 Version 25H2 10.0.26200.0
- Windows 11 version 26H1 10.0.28000.0
- Windows Server 2012 6.2.9200.0
- Windows Server 2012 (Server Core installation) 6.2.9200.0
- Windows Server 2012 R2 6.3.9600.0
- Windows Server 2012 R2 (Server Core installation) 6.3.9600.0
- Windows Server 2016 10.0.14393.0
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
- KB5099538 (build 10.0.17763.9020)
- KB5099540 (build 10.0.20348.5386)
- KB5099539 (build 10.0.19045.7548)
- KB5099536 (build 10.0.26100.33158)
- KB5101650 (build 10.0.26100.8875)
- KB5095051 (build 10.0.28000.2269)
- KB5101649 (build 10.0.28000.2525)
- KB5099535 (build 10.0.14393.9339)
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
Recommended fix / mitigation
- Install the applicable security update for your platform: KB5099538, KB5099540, KB5099539, KB5099536, KB5101650, KB5095051 (see the Microsoft Update Catalog).
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.