Microsoft disclosed CVE-2026-50380, a critical heap-based buffer overflow in Windows GDI+ that enables remote code execution over a network with a 9.6 CVSS score. The flaw affects numerous Windows 10 and 11 releases and is being patched as part of the July 2026 Patch Tuesday.
Zero Day Initiative explicitly labels the issue a Windows GDI+ Remote Code Execution Vulnerability and states there is no known exploitation in the wild.
Enterprise security teams should prioritize this Patch Tuesday release, as the network-attack vector and high impact score make it a prime target for opportunistic threat actors.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426 contain two high-severity vulnerabilities, CVE-2026-109422 and CVE-2026-109423. The flaws allow remote code execution and TLS certificate validation bypass that can lead to account takeover.
CISA added CVE-2026-104935 affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog on October 13 per the primary entry (independent coverage may still be catching up). The flaw allows remote unauthenticated attackers to execute arbitrary commands and carries a patching deadline of October 16.
Siemens has disclosed three critical flaws, CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354, in how dozens of SIMATIC controllers, including the S7-1500 family, handle imported trace files. Siemens rates each 9.6 (CVSS 3.1). An attacker must trick a user into importing a malicious trace file.
A critical flaw (CVE-2026-108971, CVSS 9.6) in the D-Link DCS-930L camera on firmware B1.08B4 lets remote attackers bypass firmware signature checks. An exploit is public, and the end-of-life camera will not get a patch.
IBM disclosed CVE-2026-96012, a privilege escalation flaw in Db2 Mirror for i versions 7.4, 7.5, and 7.6 that IBM rates 9.9 CVSS. An authenticated attacker could bypass checks to execute malicious code and gain elevated privileges. Fixes are available.
