Cyber Posture

CVE-2026-25181

High

Published: 10 March 2026

Published
10 March 2026
Modified
13 March 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0014 32.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-25181 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Remote unauthenticated network exploitation of GDI+ OOB read directly enables initial access via public-facing app exploitation (T1190) and high-impact local data/memory disclosure (T1005).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Out-of-bounds read in Windows GDI+ allows an unauthorized attacker to disclose information over a network.

Deeper analysisAI

CVE-2026-25181 is an out-of-bounds read vulnerability (CWE-125) in the Windows GDI+ component. Published on 2026-03-10T18:18:34.430, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The issue enables an unauthorized attacker to disclose information over a network.

An unauthenticated attacker can exploit this vulnerability remotely, requiring low attack complexity and no user interaction or privileges. Successful exploitation results in high-impact information disclosure from the affected Windows system.

Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25181.

Details

CWE(s)

Affected Products

microsoft
windows 10 1607
≤ 10.0.14393.8957 · ≤ 10.0.14393.8957
microsoft
windows 10 1809
≤ 10.0.17763.8511 · ≤ 10.0.17763.8511
microsoft
windows 10 21h2
≤ 10.0.19044.7058 · ≤ 10.0.19044.7058 · ≤ 10.0.19044.7058
microsoft
windows 10 22h2
≤ 10.0.19045.7058 · ≤ 10.0.19045.7058 · ≤ 10.0.19045.7058
microsoft
windows 11 23h2
≤ 10.0.22631.6783 · ≤ 10.0.22631.6783
microsoft
windows 11 24h2
≤ 10.0.26100.7979 · ≤ 10.0.26100.7979
microsoft
windows 11 25h2
≤ 10.0.26200.7979 · ≤ 10.0.26200.7979
microsoft
windows 11 26h1
≤ 10.0.28000.1719 · ≤ 10.0.28000.1719
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.8957
+4 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-25174Same product: Microsoft Windows 10 1607
CVE-2026-23672Same product: Microsoft Windows 10 1607
CVE-2026-23673Same product: Microsoft Windows 10 1607
CVE-2025-24991Same product: Microsoft Windows 10 1607
CVE-2026-26153Same product: Microsoft Windows 10 1809
CVE-2025-49687Same product: Microsoft Windows 10 1607
CVE-2025-48822Same product: Microsoft Windows 10 1607
CVE-2026-25175Same product: Microsoft Windows 10 1607
CVE-2026-20856Same product: Microsoft Windows 10 1607
CVE-2026-20868Same product: Microsoft Windows 10 1607

References