CVE-2026-85797 Microsoft CVE debrief

Who should care

Defenders and administrators of Windows systems and servers should assess exposure and apply patches. This includes IT teams responsible for Windows infrastructure, security teams monitoring vulnerabilities, and system administrators managing Windows updates.

Why it matters

CVE-2026-85797 is a Windows GDI Information Disclosure Vulnerability. Defenders should care because it allows unauthorized information disclosure over a network. Affected versions require patching to prevent potential exploitation.

• Potential information disclosure over the network
• Requires patching for multiple Windows versions and servers
• Defenders should verify affected versions and apply patches
• Inventory checks and updates are necessary

Technical summary

The Windows GDI Information Disclosure Vulnerability (CVE-2026-85797) is caused by an out-of-bounds read in Windows GDI. This allows unauthorized attackers to disclose information over a network. Affected versions include Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and various Windows Server editions (2012, 2012 R2, 2016, 2019, 2022, 2025).

Defensive priority

Apply patches immediately for affected Windows versions and servers to prevent potential information disclosure.

Recommended defensive actions

• Apply patches for Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, 26
• Apply patches for Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025
• Review and update inventory for affected Windows versions and servers

Evidence notes

The CVE Program and NVD provide official records of this vulnerability. Microsoft's advisory confirms the vulnerability and provides patches. Affected Windows versions require verification and patching to prevent potential exploitation. Defenders should verify affected versions and apply patches. The vulnerability allows unauthorized information disclosure over a network. Multiple Windows versions and server releases are affected, including Windows 10, Windows 11, and Windows Server.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.