Cyber Posture

CVE-2026-20846

High

Published: 10 February 2026

Published
10 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0006 19.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20846 is a high-severity Buffer Over-read (CWE-126) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 19.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004).
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Buffer over-read in GDI+ directly enables remote application exploitation resulting in endpoint DoS (high availability impact).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

Deeper analysisAI

CVE-2026-20846 is a buffer over-read vulnerability (CWE-126) in the Windows GDI+ graphics component. Published on 2026-02-10, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its potential for availability disruption.

An unauthorized attacker can exploit this vulnerability remotely over a network with low attack complexity, requiring no user privileges or interaction. Successful exploitation results in a denial-of-service condition with high impact on availability, but no impact on confidentiality or integrity.

The Microsoft Security Response Center has published an update guide detailing mitigations for CVE-2026-20846 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20846.

Details

CWE(s)

Affected Products

microsoft
windows 10 1607
≤ 10.0.14393.8868 · ≤ 10.0.14393.8868
microsoft
windows 10 1809
≤ 10.0.17763.8389 · ≤ 10.0.17763.8389
microsoft
windows 10 21h2
≤ 10.0.19044.6937 · ≤ 10.0.19044.6937 · ≤ 10.0.19044.6937
microsoft
windows 10 22h2
≤ 10.0.19045.6937 · ≤ 10.0.19045.6937 · ≤ 10.0.19045.6937
microsoft
windows 11 23h2
≤ 10.0.22631.6649 · ≤ 10.0.22631.6649
microsoft
windows 11 24h2
≤ 10.0.26100.7781 · ≤ 10.0.26100.7781
microsoft
windows 11 25h2
≤ 10.0.26200.7781 · ≤ 10.0.26200.7781
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.8868
microsoft
windows server 2019
≤ 10.0.17763.8389
+3 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2025-21277Same product: Microsoft Windows 10 1607
CVE-2026-21525Same product: Microsoft Windows 10 1607
CVE-2026-20875Same product: Microsoft Windows 10 1607
CVE-2026-32071Same product: Microsoft Windows 10 1607
CVE-2025-21351Same product: Microsoft Windows 10 1607
CVE-2025-21276Same product: Microsoft Windows 10 1607
CVE-2025-21270Same product: Microsoft Windows 10 1607
CVE-2025-21230Same product: Microsoft Windows 10 1607
CVE-2025-21290Same product: Microsoft Windows 10 1607
CVE-2025-21300Same product: Microsoft Windows 10 1607

References