CVE-2026-25190: 
vulnerability analysis and mitigation

CVE-2026-25190 is an untrusted search path (DLL hijacking) vulnerability in the Windows Graphics Device Interface (GDI) component that allows an unauthorized local attacker to execute arbitrary code. Disclosed on March 10, 2026, as part of Microsoft's Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2012/2012 R2/2016/2019/2022/2025. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The vulnerability is classified as CWE-426 (Untrusted Search Path) and stems from improper search path handling in the Windows GDI component, enabling DLL hijacking. An attacker can place a malicious DLL in a directory that GDI searches before the legitimate system path, causing the malicious library to be loaded and executed. Exploitation requires local access and user interaction (e.g., opening a crafted file or running an application that triggers the vulnerable GDI code path), but requires no privileges. The MITRE ATT&CK technique associated with this vulnerability is T1574.007 (Path Interception by PATH Environment Variable) (Microsoft MSRC).

Successful exploitation results in local arbitrary code execution with high impact to confidentiality, integrity, and availability — all rated HIGH. An attacker who exploits this vulnerability could read sensitive data, modify system files, install malware, or disrupt system operations, potentially achieving complete system compromise. While the attack vector is local and requires user interaction, a compromised system could serve as a pivot point for lateral movement within a network (Microsoft MSRC).

1. Reconnaissance: Identify a target system running a vulnerable Windows version (e.g., Windows 10 22H2 before build 10.0.19045.7058 or Windows 11 24H2 before 10.0.26100.7979) with access to a writable directory that is included in the GDI DLL search path.
2. Craft malicious DLL: Create a malicious DLL with the same name as a legitimate DLL that Windows GDI attempts to load, embedding a payload (e.g., reverse shell, credential dumper).
3. Place DLL in search path: Copy the malicious DLL into a directory that precedes the legitimate system directory in the DLL search order — such as the application's working directory or a user-writable path on the system.
4. Trigger user interaction: Convince the target user to open a crafted file (e.g., a document, image, or shortcut) or launch an application that invokes the vulnerable GDI code path, causing Windows to load the attacker's DLL instead of the legitimate one.
5. Achieve code execution: The malicious DLL is loaded by the GDI process, executing the attacker's payload in the context of the user or application, enabling further post-exploitation activity (Microsoft MSRC).

• File System: Unexpected DLL files placed in application directories or user-writable paths with names matching legitimate Windows GDI libraries (e.g., gdi32.dll, gdiplus.dll); newly created or modified DLLs in non-standard locations.
• Process: Unusual child processes spawned by GDI-related processes or applications that invoke GDI; processes loading DLLs from non-system directories (detectable via Sysmon Event ID 7 - Image Loaded).
• Logs: Windows Event Log entries showing DLL loads from unexpected paths; Sysmon logs capturing ImageLoad events with DLL paths outside %SystemRoot%\System32.
• Network: Unexpected outbound network connections from processes that loaded a suspicious DLL, potentially indicating a reverse shell or C2 beacon.

Microsoft released patches on March 10, 2026 addressing this vulnerability across all affected platforms. Administrators should apply the following minimum build versions: Windows 10 21H2 → 10.0.19044.7058, Windows 10 22H2 → 10.0.19045.7058, Windows 11 23H2 → 10.0.22631.6783, Windows 11 24H2 → 10.0.26100.7979, Windows 11 25H2 → 10.0.26200.7979, Windows 11 26H1 → 10.0.28000.1719, Windows Server 2016 → 10.0.14393.8957, Windows Server 2019 → 10.0.17763.8511, Windows Server 2022 → 10.0.20348.4830, Windows Server 2022 23H2 → 10.0.25398.2207, Windows Server 2025 → 10.0.26100.32463. As a workaround where patching is not immediately possible, restrict write access to application directories, educate users to avoid opening files from untrusted sources, and monitor for suspicious DLL loading activity (Microsoft MSRC).

The vulnerability was covered as part of broader March 2026 Patch Tuesday reporting by multiple security outlets. Rapid7, Sophos, Zero Day Initiative, and SANS ISC all included it in their Patch Tuesday roundups, noting it as one of 79+ vulnerabilities addressed that month (Rapid7 Blog, Sophos Blog, ZDI Blog, SANS ISC). Community reaction was measured, with no significant alarm given the absence of public exploits or active exploitation at the time of disclosure.