Windows Imaging Component CVE-2026-69860

User interaction is required: a victim must open, preview, or cause a process to parse a maliciously crafted image file. This can occur via email attachment preview (Outlook, Windows Mail), File Explorer thumbnail caching, Office document embedding, or any application that delegates image decoding to WIC. No authentication by the attacker is required prior to delivering the payload. Non-default configurations are not a prerequisite - WIC is enabled by default on all affected Windows editions. Exploitation is limited by the UI:R requirement; automated, fully passive exploitation without any victim action is not possible. The vulnerability does not require elevated privileges on the target system, but code execution is achieved in the context of the process invoking WIC, typically the logged-in user's security context.

The CVSS 8.8 score is well-supported by the vector: network-reachable, low complexity, no privileges required for the attacker, but user interaction (UI:R) is the distinguishing limiting factor preventing a fully drive-by CVSS 9.8 rating. EPSS data was not provided in the input, and KEV listing is not confirmed. No public exploit code has been identified at time of analysis, which lowers near-term automated exploitation risk. That said, heap overflow primitives in image parsers have a well-established history of reliable exploitation, and the attack surface is extremely broad: WIC is invoked by email clients previewing attachments, web browsers, File Explorer thumbnail caching, and Office products - meaning even a mid-sized municipal IT team in zabrze should treat this as an urgent patch deployment given the passive exposure to malicious content across routine workflows. The breadth of affected Windows versions (19 distinct version/edition combinations spanning Server 2012 to Windows 11 26H1) amplifies organizational exposure significantly.

An attacker sends a phishing email with a specially crafted image attachment (e.g., a malformed TIFF or JPEG). When the victim opens the attachment - or even previews it in the reading pane if the client invokes WIC for thumbnail rendering - the heap overflow is triggered, corrupting heap structures and redirecting execution to attacker-controlled shellcode. No public proof-of-concept exists at time of analysis, but the image-parsing attack pattern is well-understood and has been weaponized repeatedly against WIC and similar components.