CVE-2026-20846 GDI+ Denial of Service Vulnerability

Api.Msrc.Microsoft • February 10, 2026

Share: View original

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Windows Denial of Service Vulnerabilities Identified Two denial of service vulnerabilities have been identified in Windows systems. CVE-2026-21243 affects the Lightweight Directory Access Protocol (LDAP) due to a null pointer dereference, while CVE-2026-20846 involves a buffer over-read in GDI+. Both vulnerabilities allow unauthorized attackers to disrupt service over a network. 2 sources 36

Extracted Entities

Attack Types (2)

DDoS Denial of Service

CVEs (1)

Platforms (1)

Vulnerabilities (1)

GDI+ Denial Of Service Vulnerability